Free tool · no sign-up
Risk matrix calculator and risk register template
A risk matrix rates a hazard by likelihood x consequence. On a 5x5 matrix each runs from 1 to 5, so the score runs from 1 to 25 and falls into a band: Low, Medium, High or Extreme.
Click a cell to rate a hazard, add it to the register below, and download it as a spreadsheet.
Pick likelihood and consequence
Rows are likelihood, columns are consequence. Score = likelihood x consequence.
Risk rating
Possible x Major
12out of 25HighSenior management attention, act promptly
Add it to your register
Your risk register (2)
| Hazard | Existing controls | Likelihood | Consequence | Score | Rating | Owner |
|---|---|---|---|---|---|---|
| Fall from an unprotected edge, level 3 | Edge protection; harness when edge open | 3 Possible | 5 Catastrophic | 15 | Extreme | Site manager |
| Forklift and pedestrian interaction, loading dock | Painted walkways; spotter at peak times | 3 Possible | 4 Major | 12 | High | Warehouse lead |
Opens in Excel, Google Sheets or Numbers. Nothing you type leaves your browser.
What is a risk register?
A risk register is the list of hazards a business has identified, with the controls in place for each, a rating, an owner and a review date. Work health and safety laws expect you to identify hazards, control the risks and review those controls; the register is where you show it.
- One row per hazard or risk, in plain words someone on site would recognise
- The controls that are actually in place, not the ones in the procedure
- A rating from your organisation's matrix, before and after controls
- A named owner and a next review date
Risk register example
A risk register, filled in
Six common workplace hazards, rated on the matrix above.
| Hazard | Existing controls | Likelihood | Consequence | Score | Rating | Owner |
|---|---|---|---|---|---|---|
| Fall from an unprotected edge, level 3 | Edge protection; harness when edge open | 3 Possible | 5 Catastrophic | 15 | Extreme | Site manager |
| Forklift and pedestrian interaction, loading dock | Painted walkways; spotter at peak times | 3 Possible | 4 Major | 12 | High | Warehouse lead |
| Silica dust from cutting | Wet cutting; P2 respirators | 3 Possible | 4 Major | 12 | High | Supervisor |
| Manual handling of stock over 20 kg | Two-person lift; trolleys | 4 Likely | 2 Minor | 8 | Medium | Store manager |
| Occupational violence from customers | Duress alarms; de-escalation training | 2 Unlikely | 3 Moderate | 6 | Medium | Operations manager |
| Slips on wet floors | Spill kits; wet floor signs | 3 Possible | 1 Insignificant | 3 | Low | Cleaning lead |
Example data. Ratings are residual: with the listed controls in place.
The scales
Likelihood, consequence and bands
| Likelihood | Means |
|---|---|
| 1 Rare | Could happen only in exceptional circumstances |
| 2 Unlikely | Could happen, but not expected |
| 3 Possible | Might happen at some point |
| 4 Likely | Will probably happen in most circumstances |
| 5 Almost certain | Expected to happen, or already happening |
| Consequence | Means |
|---|---|
| 1 Insignificant | No injury, or first aid only |
| 2 Minor | Medical treatment, no lost time |
| 3 Moderate | Lost time injury, full recovery |
| 4 Major | Serious injury or permanent impairment |
| 5 Catastrophic | Fatality or multiple serious injuries |
| Band | Score | Typical response |
|---|---|---|
| Low | 1 to 4 | Manage by routine procedures |
| Medium | 5 to 9 | Assign an owner and review controls |
| High | 10 to 14 | Senior management attention, act promptly |
| Extreme | 15 to 25 | Stop or do not start until controls reduce the risk |
A common default. Use the descriptors and bands your organisation has approved.
Questions
Common questions
What is a risk register?
A risk register is a list of the hazards and risks a business has identified, with the controls in place for each, a rating of how serious the risk is, who owns it and when it is next reviewed. It is the working record of how you manage risk, not a one-off document.
How do you calculate a risk rating on a 5x5 matrix?
Rate the likelihood from 1 (rare) to 5 (almost certain) and the consequence from 1 (insignificant) to 5 (catastrophic), then multiply them. The score runs from 1 to 25 and falls into a band, for example 1 to 4 Low, 5 to 9 Medium, 10 to 14 High and 15 to 25 Extreme.
Are these the right bands for my organisation?
They are a common default, not a standard. Many organisations set their own descriptors and bands, and some use a 4x4 or 3x3 matrix. Use the one your organisation has approved so ratings mean the same thing across sites.
What is the difference between inherent and residual risk?
Inherent risk is the rating before controls, residual risk is the rating with the current controls in place. Recording both shows how much each control is doing, and which risks are only acceptable because one control keeps working.
What should be in a risk register?
At minimum: the hazard, what could happen, the existing controls, the likelihood, consequence and rating, the owner, any further actions with due dates, and the next review date. The downloaded template starts with the core columns.
Is a spreadsheet good enough for a risk register?
For a small team, often yes. It starts to fail when several sites keep their own copies, reviews are missed because nobody is reminded, and actions live in someone's inbox. That is the point to move it into a system that keeps owners and review dates live.
Next step, free
Risk register from a messy spreadsheet
Clean up an existing register: consistent hazards, real controls, ratings that add up. A prompt you run in your own ChatGPT, Claude or Copilot.
Your register, with owners who actually get reminded
Send us the spreadsheet. Umbrella turns it into a live risk register with owners, review dates and actions that chase themselves, usually within 24 hours.
- Free tools, always
- Your data stays yours
- Live in 24 hours