5×5 Risk Matrices: Build a Decision Aid, Not a Decision Engine

Start by defining the scenario and what exposure the team is assessing. State the time horizon and operating basis: for example, one site over the next year, a shutdown window, a project phase or a defined number of operating hours. Without those boundaries, people can use the same likelihood label while answering different questions.

Choose likelihood from available evidence, including relevant events, operating condition, leading signals, control performance and assumptions. If evidence is incomplete, record that uncertainty. An open uncertainty is more useful to a review than a confident selection with no stated basis.

Rare, Unlikely, Possible, Probable and Almost Certain should each stand for a materially different order-of-magnitude frequency range. The bands should not mean five slightly different levels of confidence. Moving one band should signal a meaningful change in the expected frequency of the scenario.

Tailor the ranges to the operation, then use them consistently. A distribution network, processing plant and major project can need different definitions because their exposure differs. The principle stays the same: set the ranges once for the stated basis, make them visible, and do not change them between teams to make a result feel more comfortable.

Minor, Moderate, Major, Severe and Fundamental only become useful when they refer to outcomes leaders can recognise and challenge. Use distinct description rows for the outcomes that matter to the organisation: Health, Safety & Wellbeing; environment; product or process integrity; financial; and regulatory or reputation are common starting points.

A matrix should distinguish the type of harm at stake, rather than force everything through one generic consequence scale. Keep each category description short, clear and editable. That lets the owner explain the outcome behind the label, instead of asking the review to accept an abstract score.

Use three blue priority bands to show the level of attention, review or escalation the scenario needs. A coarse visual output is intentional. It supports a conversation about priority without suggesting that the cell has resolved the risk.

More colours, labels or numeric ratings can create a false impression of precision. They can also move attention away from the evidence, uncertainty and decision that matter. The visual band should be the beginning of the management discussion, not its conclusion.

Record why the scenario was placed in its cell, the evidence used, important uncertainty and the proposed controls. This is the information a later reviewer needs to understand whether the placement is still reasonable, particularly when operating conditions or dependencies change.

Then assess control performance, treatment effectiveness, cost, feasibility and escalation outside the matrix. A cell does not determine whether a control works, whether a treatment is proportionate or which authority should decide. Those are separate management and governance questions.