A Simple Grid With a Lot Riding on It
The risk matrix is probably the most widely used safety tool in Australian industry. It appears in risk assessments, permits, contractor paperwork, incident reports and board papers. It is also widely misused, and a matrix applied badly can leave a plant feeling safer on paper while nothing on the floor has changed.
This guide explains what a risk matrix is, how to score one sensibly, where it fits in Queensland’s approach to managing risk and why machinery needs more than a coloured square.
What a Risk Matrix Is
A risk matrix is a grid that combines two judgements: how likely it is that something will cause harm, and how bad the harm would be. Each is given a rating, the two are combined, and the result is a risk level, usually shown as a colour from green to red.
The most common layout is five by five. Likelihood runs from rare to almost certain and consequence from minor to catastrophic. If each is scored from 1 to 5 and the two are multiplied, the result falls between 1 and 25. Organisations then set bands, such as low, medium, high and extreme, and attach a required response to each.
The purpose is to rank. A matrix helps a site decide which risks to deal with first and who needs to approve living with what remains.
Where It Fits in Queensland’s Rules
Queensland’s guide to this subject is the How to manage work health and safety risks Code of Practice 2021. It sets out a four step process: identify hazards, assess risks if necessary, control risks, and review hazards and control measures to ensure they are working.
Two things in that code surprise people. First, the words if necessary. The code says a risk assessment may not be necessary if you already know the risk and how to control it effectively. Many hazards have well established and accepted controls, and the expectation is that you simply apply them. Second, the code does not prescribe any particular matrix. It asks you to consider how severe the harm could be and how likely it is to occur, and it notes that risk increases as severity and likelihood increase.
So a risk matrix is a tool some organisations choose to use. It is not the legal requirement. The requirement is to eliminate risks so far as is reasonably practicable and, where that is not possible, to minimise them. Some activities do carry a mandatory risk assessment, including entry to confined spaces and live electrical work.
Scoring Likelihood
The Queensland code describes five levels of likelihood: certain, very likely, possible, unlikely and rare. It asks you to consider how often people are exposed to the hazard and for how long, how effective existing controls are, whether changes in the organisation could increase the chance of harm, the working environment, and how people actually behave, including when they are tired or rushed.
The common mistake is to score likelihood from memory: it has never happened here, so it must be rare. A plant that has run a machine for ten years without an injury may have been careful, or lucky. Look at exposure. A task done forty times a shift by every operator is a very different proposition from one done twice a year by a fitter.
Scoring Consequence
Consequence should be the most severe outcome that could reasonably result, not the most common one. Most contacts with a moving conveyor end in a fright. The one that matters ends in an amputation.
The code’s questions are useful here. Could the hazard cause death, serious injury or illness, or only minor injury? How many people could be affected? Could one event lead to others? If the honest answer includes a fatality or a permanent injury, score it that way, however unlikely it seems.
A Worked Example
Take a labelling machine where operators reach in to clear jams. The guard door has an interlock, but it has been unreliable and operators have learned that the machine can be jogged with the door open.
Likelihood. Jams happen several times a shift and every operator clears them. With a defeated interlock, contact with moving parts is likely.
Consequence. Crush or entanglement injuries to the hand, potentially permanent.
Rating. High, on any reasonable matrix.
Now the important part. The matrix has told you this is urgent. It has not told you what to do. That comes from the hierarchy of control.
The Hierarchy of Control Is Where the Work Happens
The code ranks control measures from most to least effective. Elimination comes first. Then substitution, isolation and engineering controls. Then administrative controls such as procedures and training. Personal protective equipment comes last.
For the labeller, eliminating the jam at its source might mean correcting a label feed problem so that nobody needs to reach in at all. An engineering control would be a reliable interlock that cannot be defeated, with a jog function that works only under safe conditions. A sign and a toolbox talk are administrative controls, and on their own they sit near the bottom of the list.
A risk assessment that scores a hazard, adds a procedure and rescores it as low has usually skipped the levels that matter. The code is direct about cost as well. It is one of the factors in deciding what is reasonably practicable, but it cannot be used as a reason for doing nothing.
Five Ways Risk Matrices Go Wrong
The score becomes the goal. Teams argue about whether something is a 9 or a 12 instead of what to do about it.
Residual risk is adjusted to fit. A control is written down, the likelihood is dropped two levels and the square turns green, whether or not the control is in place and working.
Severe but unlikely events are averaged away. A fatality risk scored as rare can land in the same band as a frequent minor injury. They are not the same problem and should not be managed the same way.
Different people give different answers. Without agreed definitions, two assessors will score the same hazard two bands apart.
The assessment is never revisited. The code expects controls to be reviewed when they prove ineffective, before changes to the workplace and when new hazards are found. A matrix filled in at installation says little about a machine that has been modified three times since.

Why Machinery Needs More Than a Matrix
A general risk matrix is a reasonable first pass for a machine. It is not enough to design a safety system. Machine safety work in Australia follows the AS/NZS 4024 Safety of Machinery series, in which AS/NZS 4024.1201 deals with risk assessment and risk reduction.
When a control measure depends on a control system, such as an interlock, a light curtain or an emergency stop, the question changes from how risky is this to how reliable must this safety function be. That is answered with a structured method that considers the severity of injury, how often people are exposed and whether the hazard can be avoided, and it produces a required performance level for the safety function. The circuit then has to be designed and validated to achieve it.
This is the point where a plant risk assessment hands over to functional safety engineering. It is also where modifications cause trouble, because changing a machine can change the risk and the performance its safety functions need.
Making Your Matrix Useful
Define every likelihood and consequence level in words people can apply, with examples from your own site. Assess with the people who do the job, because they know how it is really done. Record the controls that actually exist, not the ones in the manual. Treat any credible fatality or permanent injury as needing attention regardless of the score. Check that controls are in place before rescoring. Keep the record, since the code notes that records demonstrate what you have done to comply. And set a trigger for review: any modification, any incident and any change to how the task is done.

Where BevTech Fits
BevTech is a family owned engineering business in Richlands, Brisbane, with more than 25 years in beverage and FMCG manufacturing. Much of our work begins where a risk assessment ends: designing and installing the engineering controls it calls for. Our TUV certified functional safety engineers and industrial electricians upgrade guard interlocks, light curtains, safety relays and emergency stop circuits, and our machine shop makes the guards and change parts that remove the need to reach in.
If a risk assessment on your site has produced actions that need engineering, use the contact form at bevtech.com.au/contact.
This article is a general guide current as at October 2026 and is not legal advice. Refer to the code of practice and Workplace Health and Safety Queensland for the requirements that apply to your workplace.






