A risk assessment matrix is a simple tool used to evaluate the level of risk before starting maintenance work.
In industrial maintenance, engineers and supervisors use a risk matrix to understand how serious a hazard is and what controls are required before the job can proceed.
A good risk assessment helps reduce incidents, improve planning, and support safe decision-making.
What Is a Risk Assessment Matrix?
A risk assessment matrix is a table used to rate risk based on two main factors:
- Likelihood
- Severity
Likelihood means how likely the incident is to happen.
Severity means how serious the consequence could be if it happens.
By combining likelihood and severity, the risk level can be classified as low, medium, high, or extreme.
Why Risk Assessment Is Important in Maintenance
Maintenance work often involves changing conditions, troubleshooting, isolation, heavy tools, electrical systems, rotating equipment, pressure, height, and hot surfaces.
Risk assessment helps identify hazards before the work starts.
It helps answer important questions such as:
- What can go wrong?
- How likely is it to happen?
- How serious could the consequence be?
- What controls are needed?
- Is the job safe to proceed?
- Does the job need additional approval?
Basic Risk Formula
The basic risk formula is:
Risk = Likelihood × Severity
For example:
If the likelihood is 3 and the severity is 4, the risk rating is:
3 × 4 = 12
The final number is then compared with the risk matrix to determine the risk level.
Likelihood Rating
Likelihood means the chance of the hazard causing an incident.
A simple likelihood scale may look like this:
| Rating | Likelihood | Description |
|---|---|---|
| 1 | Rare | Unlikely to happen |
| 2 | Unlikely | Could happen but not expected |
| 3 | Possible | May happen sometimes |
| 4 | Likely | Expected to happen in some situations |
| 5 | Almost Certain | Very likely to happen |
The exact rating system may differ depending on company procedure.
Severity Rating
Severity means the seriousness of the possible consequence.
A simple severity scale may look like this:
| Rating | Severity | Description |
|---|---|---|
| 1 | Minor | First aid or minor damage |
| 2 | Moderate | Medical treatment or limited damage |
| 3 | Serious | Lost time injury or significant damage |
| 4 | Major | Permanent injury or major damage |
| 5 | Catastrophic | Fatality or multiple serious injuries |
Severity should be rated based on the worst credible consequence, not the best-case scenario.
Risk Matrix Example
A simple 5×5 risk matrix may look like this:
| Severity / Likelihood | 1 Rare | 2 Unlikely | 3 Possible | 4 Likely | 5 Almost Certain |
|---|---|---|---|---|---|
| 1 Minor | 1 | 2 | 3 | 4 | 5 |
| 2 Moderate | 2 | 4 | 6 | 8 | 10 |
| 3 Serious | 3 | 6 | 9 | 12 | 15 |
| 4 Major | 4 | 8 | 12 | 16 | 20 |
| 5 Catastrophic | 5 | 10 | 15 | 20 | 25 |
The higher the number, the higher the risk.
Risk Level Classification
A typical risk level classification may be:
| Risk Score | Risk Level | Action |
|---|---|---|
| 1 to 4 | Low | Work may proceed with normal controls |
| 5 to 9 | Medium | Additional controls may be required |
| 10 to 16 | High | Supervisor or safety approval required |
| 17 to 25 | Extreme | Work should not proceed until risk is reduced |
Each company may use different colors, limits, and approval levels.
Initial Risk and Residual Risk
Risk assessment usually includes two risk ratings:
- Initial risk
- Residual risk
Initial risk is the risk level before applying controls.
Residual risk is the remaining risk after controls are applied.
The goal is to reduce the risk to an acceptable level before starting work.
Example: Electrical Panel Maintenance
Task: Tightening terminals inside an electrical panel.
Hazard: Electrical shock.
Initial risk:
- Likelihood: 3 Possible
- Severity: 5 Catastrophic
- Risk score: 15 High
Controls:
- Isolate power supply
- Apply LOTO
- Verify absence of voltage
- Use insulated tools
- Use proper PPE
- Allow only competent electrician
Residual risk:
- Likelihood: 1 Rare
- Severity: 5 Catastrophic
- Risk score: 5 Medium
The severity remains high because electrical shock can still be serious, but likelihood is reduced by proper controls.
Example: Work at Height
Task: Replacing high-bay light using scaffolding.
Hazard: Fall from height.
Initial risk:
- Likelihood: 3 Possible
- Severity: 5 Catastrophic
- Risk score: 15 High
Controls:
- Approved Work at Height permit
- Inspected scaffolding
- Full body harness if required
- Guardrails and toe boards
- Barricade below
- Tool lanyards
- Rescue plan
- Competent workers
Residual risk:
- Likelihood: 1 Rare
- Severity: 5 Catastrophic
- Risk score: 5 Medium
Example: Pump Maintenance
Task: Replace mechanical seal on a pump.
Hazards may include:
- Electrical startup
- Pressure release
- Hot fluid
- Chemical exposure
- Manual handling
- Sharp edges
- Rotating parts
Each hazard should be rated separately.
Example hazard: Unexpected pump startup.
Initial risk:
- Likelihood: 3 Possible
- Severity: 4 Major
- Risk score: 12 High
Controls:
- Electrical isolation
- LOTO
- Process isolation
- Verify zero energy
- Communication with operation
Residual risk:
- Likelihood: 1 Rare
- Severity: 4 Major
- Risk score: 4 Low
Hierarchy of Controls
When reducing risk, use the hierarchy of controls.
The hierarchy usually includes:
- Elimination
- Substitution
- Engineering controls
- Administrative controls
- PPE
PPE should not be the first or only control.
Elimination
Elimination means removing the hazard completely.
Example:
Instead of working at height, lower the equipment to ground level if possible.
Elimination is the most effective control.
Substitution
Substitution means replacing the hazard with something safer.
Example:
Use a safer cleaning chemical instead of a more hazardous chemical.
Engineering Controls
Engineering controls physically reduce exposure to the hazard.
Examples include:
- Machine guards
- Interlocks
- Fixed platforms
- Barriers
- Local exhaust ventilation
- Electrical protection devices
- Pressure relief systems
Administrative Controls
Administrative controls manage how people work.
Examples include:
- Work permits
- Procedures
- Training
- Toolbox talks
- Warning signs
- Supervision
- Rotation of workers
- JSA
Administrative controls depend on people following the procedure.
PPE
PPE is the last line of defense.
Examples include:
- Safety helmet
- Safety glasses
- Gloves
- Face shield
- Arc flash PPE
- Full body harness
- Safety shoes
- Hearing protection
PPE reduces injury but does not remove the hazard.
Common Hazards in Maintenance Risk Assessment
Common hazards include:
- Electrical shock
- Arc flash
- Rotating equipment
- Stored pressure
- Hydraulic energy
- Pneumatic energy
- Work at height
- Hot surfaces
- Chemical exposure
- Manual handling
- Lifting operations
- Confined space
- Noise
- Dust
- Slips and trips
- Falling objects
- Sharp edges
- Poor lighting
Risk Assessment Checklist
| Check Point | What to Verify |
|---|---|
| Job scope | Clear and specific |
| Location | Correct area and equipment |
| Hazards | All major hazards identified |
| Likelihood | Rated realistically |
| Severity | Based on credible worst consequence |
| Initial risk | Calculated before controls |
| Controls | Practical and effective |
| Residual risk | Calculated after controls |
| Approval | Required level obtained |
| Communication | Discussed during toolbox talk |
| Review | Updated if job conditions change |
Common Risk Assessment Mistakes
Common mistakes include:
- Copying old risk assessments without review
- Rating risk too low to avoid approval
- Ignoring stored energy
- Ignoring simultaneous activities
- Treating PPE as the only control
- Missing environmental conditions
- Not involving the work team
- Not updating the risk assessment when conditions change
- Using general controls that do not match the hazard
- Ignoring emergency response or rescue plan
Risk Assessment and Work Permit
Risk assessment is often linked to the work permit.
Before issuing a permit, the responsible person may review:
- Job scope
- Hazards
- Control measures
- Required isolation
- Required PPE
- Special permits
- Emergency arrangements
- Approval levels
The work permit authorizes the job, while the risk assessment explains how the job will be controlled.
Risk Assessment and JSA
A JSA and a risk assessment are closely related.
A JSA breaks the job into steps and identifies hazards and controls for each step.
A risk assessment rates the risk level and helps decide whether controls are enough.
In many companies, JSA and risk assessment are combined in one form.
Practical Field Example
A team needs to perform maintenance on a conveyor.
Hazards include electrical energy, moving parts, stored mechanical energy, pinch points, and manual handling.
Before work starts, the team rates the risks, applies LOTO, installs barricades, uses proper tools, and discusses the JSA.
After controls are applied, the residual risk is reviewed. If the risk is still high, the job should not start until additional controls are applied.
When to Review the Risk Assessment
The risk assessment should be reviewed when:
- Job scope changes
- Work location changes
- Weather changes
- New hazards appear
- Equipment condition is different from expected
- New workers join the job
- Work is delayed or extended
- Simultaneous work starts nearby
- An incident or near miss occurs
Risk assessment is not a one-time paperwork activity. It should reflect the real job condition.
Safety Notes
A risk matrix is a decision support tool, not a replacement for engineering judgment, site procedures, or legal requirements.
If there is uncertainty, stop work and review the hazards and controls.
High-risk maintenance activities should always be reviewed by competent people before work starts.
Conclusion
A risk assessment matrix helps maintenance engineers evaluate hazards based on likelihood and severity.
It supports safe decision-making by identifying initial risk, control measures, and residual risk.
For electrical work, mechanical work, work at height, pump maintenance, panel maintenance, and shutdown jobs, proper risk assessment helps reduce incidents and improve maintenance safety.
A good risk assessment should be specific, realistic, reviewed with the team, and updated when job conditions change.
