5x5 Risk Matrix Explained | UK Guide 2026

Last updated: 17 October 2026

A 5x5 risk matrix is a risk assessment tool that scores hazards on two five-point scales — likelihood and severity — then multiplies them to produce a rating from 1 to 25. It's used across UK construction, security, facilities and manufacturing to prioritise which risks need controls first, and to give inspectors and clients evidence that risk was assessed systematically rather than guessed at.

Key Takeaways

• Pulse Operations notes that a 5x5 risk matrix scores likelihood (1-5) and severity (1-5), multiplying them to give a risk rating between 1 and 25.
• Pulse Operations notes that the matrix itself is not a legal requirement in the UK, but the Management of Health and Safety at Work Regulations 1999 require a "suitable and sufficient" risk assessment, and a 5x5 matrix is one accepted way to satisfy it.
• Nearly 75% of enterprises experienced at least one critical risk event in the past year, mostly cyberattacks and IT failures, according to Forrester's 2026 Business Risk Survey (via Risk Publishing).
• Firms without board-level enterprise risk management (ERM) visibility were 20% more likely to suffer six or more critical risk events, per Secureframe (via Risk Publishing) (2026).
• Colour zones — typically green, yellow, amber and red — translate a numeric score into an instant visual signal for who needs to act and how fast.

What is a 5x5 risk matrix and how does it work?

A 5x5 risk matrix is a grid-based risk assessment tool that plots the likelihood of a hazard occurring against the severity of its consequences, each scored on a five-point scale, to produce a combined risk rating. The two scales intersect on a 5-row, 5-column grid — 25 cells in total — with each cell pre-assigned a risk band (low, medium, high, extreme) and usually a colour.

The concept traces back to formal risk engineering. The Wikipedia entry on risk matrices notes the format was codified in the US Department of Defense's MIL-STD-882B standard, and it has since become the default visual tool referenced in HSE's operational risk guidance and aligned internationally with ISO 31000.

Compared with a 3x3 matrix (9 cells), the 5x5 gives finer resolution — useful where an organisation runs varied sites, contracts or hazard types, such as a security company covering both quiet residential blocks and live construction sites. Compared with a bare checklist, it forces an explicit likelihood-and-severity judgement for every hazard identified, which is exactly what UK enforcement bodies expect to see recorded during an inspection or after an incident.

How do you score likelihood and severity on a 5x5 scale?

Likelihood and severity are the two independent variables scored on a 5x5 matrix, each rated from 1 (lowest) to 5 (highest) using fixed, pre-agreed definitions. Likelihood asks "how often could this happen?"; severity asks "how bad would it be if it did?" — and both need written definitions before anyone starts scoring, or two assessors will produce two different answers for the same hazard.

A typical likelihood scale runs: 1 – rare (may occur only in exceptional circumstances), 2 – unlikely, 3 – possible, 4 – likely, 5 – almost certain (expected to occur in most circumstances). A typical severity scale runs: 1 – negligible (first aid only), 2 – minor (medical treatment, no lost time), 3 – moderate (lost-time injury), 4 – major (serious injury, RIDDOR-reportable), 5 – catastrophic (fatality or multiple fatalities).

For a facilities or security context, severity definitions should also cover non-injury consequences: reputational damage, contract loss, regulatory breach, or a Martyn's Law compliance failure at a licensed premises. Whatever the scale, the definitions belong in the risk assessment document itself — not left to individual judgement on the day.

How do you calculate a risk rating using a 5x5 matrix?

A risk rating on a 5x5 matrix is calculated by multiplying the likelihood score by the severity score, giving a number between 1 (1×1) and 25 (5×5). A hazard scored likelihood 3 (possible) and severity 4 (major) produces a risk rating of 12 — landing in the "high" band on most standard templates.

The calculation itself is simple arithmetic; the judgement is in the two inputs. Most UK templates then group the 1-25 range into bands, commonly:

Bands should be set before scoring begins, not adjusted afterwards to make an inconvenient result look acceptable. This is where a documented ERM (enterprise risk management) process pays off: Secureframe's data via Risk Publishing found firms without board-level ERM visibility were 20% more likely to suffer six or more critical risk events, which suggests the discipline of consistent scoring matters as much as the scale you use.

What do the colour zones mean on a 5x5 risk matrix?

Colour zones on a 5x5 risk matrix are the visual shorthand for risk bands — typically green, yellow, amber and red — that let anyone read the grid at a glance without recalculating scores. Green usually covers ratings 1-4 (acceptable, routine monitoring), yellow or light amber covers 5-9 (tolerable with existing controls), amber covers 10-15 (needs additional controls and a review date), and red covers 16-25 (unacceptable — work should stop or not start until risk is reduced).

The colours aren't decorative. On a live risk register, they let a duty holder, an SIA-licensed supervisor, or a facilities manager triage a long list of hazards in seconds rather than re-reading every score. Red-zone items should trigger an automatic escalation — a named owner, a deadline, and sign-off before closure — rather than sitting in a spreadsheet cell.

For businesses managing multiple sites, colour-coding only works if it's applied consistently across every register. A common failure mode: one manager's amber is another's red because band definitions weren't agreed centrally. This is precisely the kind of drift Pulse Operations sees in facilities and security operations juggling paper-based or spreadsheet risk logs across a portfolio — see the compliance runway approach to keeping standards consistent site to site.

Is a 5x5 risk matrix a legal requirement under UK health and safety law?

A 5x5 risk matrix is not itself a legal requirement under UK health and safety law — no statute names it specifically. What the law requires is a "suitable and sufficient" risk assessment under Regulation 3 of the Management of Health and Safety at Work Regulations 1999, made under the Health and Safety at Work etc. Act 1974, and the 5x5 matrix is one widely accepted method of demonstrating that.

The HSE's own guidance describes combining likelihood and severity factors into a matrix as part of its internal operational procedure, which is why the format carries practical weight even without being written into statute. HSE's five-step framework (identify hazards, decide who might be harmed, evaluate risk and decide on precautions, record findings, review and update) sits comfortably alongside a 5x5 scoring grid — the KeyOstas summary of this process is a useful plain-English reference.

For enhanced-tier premises under the Terrorism (Protection of Premises) Act 2026 — commonly known as Martyn's Law — a documented risk assessment that stays current, not a one-off exercise, is a specific duty. Pulse Operations's own guide, Martyn's Law: a readiness guide for security & FM teams, sets out the two-tier system: standard tier broadly covers premises where 200 to 799 people may be present, and enhanced tier broadly covers 800 or more, with enhanced sites required to keep a documented risk assessment current rather than filed and forgotten.

How does a 5x5 risk matrix compare to a 3x3 risk matrix?

A 3x3 risk matrix is a simpler version of the same tool, scoring likelihood and severity on a three-point scale (low, medium, high) instead of five, giving nine possible outcomes instead of 25. The trade-off is resolution versus speed: a 3x3 matrix is faster to complete and easier to train staff on, but it compresses distinct risks into the same box more often, which can hide meaningful differences between two "medium" hazards that are actually quite far apart.

Neither format is mandated by ISO 31000 or IEC 31010, both of which describe risk matrices as one technique among several. A security or FM contractor bidding for larger, multi-site contracts will usually find clients expect the finer granularity a 5x5 gives, particularly where tender scoring compares risk management maturity between bidders — see Pulse Operations's notes on tender readiness.

Common mistakes businesses make when using a 5x5 risk matrix

The most common mistake with a 5x5 risk matrix is treating the multiplication as objective maths when the inputs are subjective judgements — a score of 12 feels precise, but it's built from two opinions, not two measurements. This is a genuine, well-documented criticism of risk matrices generally, not a flaw unique to poor implementation.

Other recurring errors include:

• Scoring inherent risk only — assessing the hazard as if no controls exist, without a second residual-risk score showing what the rating becomes after controls are applied.
• Vague band definitions — "likely" and "possible" left undefined, so different assessors score the same hazard differently.
• No review date attached to red or amber items — a high score gets recorded once and never revisited.
• Static, disconnected registers — a spreadsheet risk matrix sitting separately from the incident log, so a real-world event that should trigger a re-score never reaches the document.
• Confusing severity axes — mixing injury severity with financial or reputational severity on the same scale without separate definitions for each.

Forrester's 2026 Business Risk Survey found nearly 75% of enterprises experienced at least one critical risk event in the past year, mostly cyberattacks and IT failures — a reminder that a matrix focused only on physical safety risk will miss the categories most likely to actually bite. In the US, Bureau of Labor Statistics data via OSHA Workplace Safety recorded more than 2.6 million nonfatal workplace injuries across private industry in 2023, underlining why physical hazard scoring still matters even as risk categories broaden.

For security and FM operators specifically, the disconnect between the risk register and the operational record is the recurring failure Pulse Operations sees. A patrol risk assessment might flag a poorly-lit service yard as amber, but if the checkpoint evidence, incident reports and the risk register live in three different systems, nobody notices the pattern until something happens. Pulse Operations's photo-verified patrols — every checkpoint completed by a mandatory watermarked photograph showing officer, site, GPS and time, with no QR or NFC tag scans by design — feed directly into the same incident and occurrence book, so a recurring finding at a site surfaces before it becomes a red-zone event rather than after.

"Run the new system in parallel on one site before you switch anything off. We migrate the data, the officers learn the app on shift one, and nothing gets decommissioned until you're confident. Switching feels risky because vendors make it a leap — it should be a walk." — Mo Hassan, Founder, Pulse

How often should a risk matrix be reviewed and updated?

A risk matrix should be reviewed whenever circumstances change — a new hazard is introduced, an incident occurs, equipment or personnel change, or a set interval (commonly annually) passes without any of those triggers occurring. HSE's five-step framework treats "review and update" as a standing step, not a one-off box to tick after the initial assessment.

For higher-risk or higher-turnover environments — construction sites, event security, multi-building residential estates — a fixed annual review isn't enough on its own. A prestige central-London residential estate working with Pulse Operations, covering 16 buildings on one nightly patrol round, needed to prove every building actually received its patrols every night, not just that a round was logged as "complete." Since going live on Pulse in March 2026, the estate has recorded more than 4,100 patrols — roughly 250-280 per building — with checkpoint completions moving from unverified to 100% photo-verified, and recurring-findings detection surfacing repeat faults automatically rather than waiting for the next scheduled review.

That kind of continuous evidence trail turns risk review from an annual paperwork exercise into something closer to real time — exactly the direction UK enforcement and client expectations are heading, particularly for enhanced-tier Martyn's Law sites where a current, not historic, risk assessment is a specific duty.

Your 5x5 risk matrix checklist

• Agree written definitions for every point on the likelihood scale (1-5) before scoring starts.
• Agree written definitions for every point on the severity scale (1-5), covering injury, financial, reputational and regulatory consequences separately if needed.
• Set risk band thresholds (e.g. 1-4 low, 5-9 medium, 10-15 high, 16-25 extreme) and colour-code them consistently across every site and register.
• Score inherent risk first, then re-score residual risk after controls are applied.
• Attach a named owner and review date to every amber and red-rated hazard.
• Cross-reference the risk register against incident logs and patrol or checkpoint records so real-world events trigger a re-score.
• Review the whole matrix at least annually, and immediately after any notifiable incident, new hazard, or significant change to site, staffing or activity.
• For enhanced-tier premises under Martyn's Law, confirm the risk assessment is kept current rather than treated as a one-off document.

FAQ

What is a 5x5 risk matrix?

A 5x5 risk matrix is a risk assessment grid that scores likelihood and severity on separate five-point scales and multiplies them to give a combined risk rating from 1 to 25. It's used to prioritise which hazards need controls first and is a widely recognised format referenced in HSE guidance.

How do you calculate risk using a 5x5 risk matrix?

Multiply the likelihood score (1-5) by the severity score (1-5) to get a risk rating between 1 and 25. That number is then mapped onto a pre-agreed band — commonly low, medium, high or extreme — with each band carrying a different required response.

What score is considered high risk on a 5x5 matrix?

Most standard UK templates treat a score of 10-15 as "high" and 16-25 as "extreme" or "critical," though exact thresholds vary by organisation. Whatever bands are chosen, they should be fixed in writing before scoring begins so results are comparable across sites and assessors.

Is a 5x5 risk matrix a legal requirement in the UK?

No single UK law names the 5x5 matrix specifically. The Management of Health and Safety at Work Regulations 1999 require a "suitable and sufficient" risk assessment, and a 5x5 matrix is one accepted way of documenting that judgement.

What's the difference between a 3x3 and a 5x5 risk matrix?

A 3x3 matrix scores likelihood and severity on three points each (nine possible outcomes), while a 5x5 uses five points each (25 outcomes), giving finer resolution. Larger, multi-site or higher-risk operations generally benefit from the extra granularity a 5x5 provides, particularly for contractor tender scoring.

What are the main limitations of a 5x5 risk matrix?

The core criticism is that multiplying two subjective scores produces a number that looks objective but isn't, and that "middle-box crowding" can group meaningfully different risks together. Well-run matrices mitigate this with clear written definitions, separate inherent and residual scores, and regular review rather than treating the tool as purely mechanical.

How often should a 5x5 risk matrix be reviewed?

Review whenever a new hazard appears, an incident occurs, or personnel and equipment change, plus at a fixed minimum interval — commonly annually. Higher-turnover sites, such as multi-building estates or event venues, benefit from continuous evidence — such as photo-verified patrol records — rather than relying solely on an annual paper review.

Bringing evidence to your risk matrix with Pulse Operations

A 5x5 risk matrix is only as reliable as the evidence feeding it — a score of "amber, monitor" is meaningless if nobody can show whether the monitoring actually happened. Pulse Operations exists to close that gap for UK security and facilities operators: every patrol checkpoint is completed by a mandatory watermarked photograph showing officer, site, GPS and time, with no QR or NFC tag scans by design, so the risk register connects directly to what was actually checked on the ground.

That evidence trail already runs live across Pulse Operations's own founding operation, Priority First, where a landmark West London mixed-use development has recorded more than 540 patrols across 152 photo-mandatory checkpoints in its first five months live — production data as of July 2026 (see /benchmark for the platform-wide figures, including a 96.2% photo-verification rate over the trailing 90 days). Recurring findings from those checkpoints feed straight into incidents and the tamper-evident daily occurrence book, so a repeat amber-rated issue gets flagged before it becomes a red one.

If your risk matrix is currently disconnected from what your officers or engineers actually record on site, book a look at Pulse Operations's photo-verified patrols and compliance runway — pricing is published openly at /pricing, and most operators run a parallel site before switching anything off.

Related Reading

• QR Code Guard Tour Disadvantages: UK Guide 2026
• Security Guard Handover Best Practice UK (2026 Guide)
• Security Patrol Frequency Best Practice UK (2026 Guide)

★ Add pulse-operations.co.uk as a preferred source on Google