Skip to content
STEELTOETOOLS

Risk Assessment Matrix Generator — Free 5×5 Template

Set the five severity levels and the five likelihood levels in your own words, list the hazards, and the sheet scores each one before and after the controls you plan to add. Nothing here is a regulatory scale: OSHA publishes no matrix and no numbers, and a low score never makes a serious recognized hazard acceptable. Print it or download the PDF. Nothing you type is sent to our servers.

A matrix prioritizes. It does not authorize. OSHA publishes no risk matrix and no acceptable score, and its guidance is explicit that employers have an ongoing obligation to control all serious recognized hazards — whatever order your numbers put them in. Use this to decide what you deal with first, never to decide that a serious hazard can stay.

The people who do the work, with someone who can authorize the fix.
The number of workers who might be exposed is part of OSHA's characterization step.

Nothing you type is sent to our servers. A draft is kept in this browser until you clear it.

Template for informational purposes only. This document must be reviewed and adapted by a competent or qualified person for your specific jobsite, equipment, and applicable federal, state, and local requirements. It does not constitute legal, engineering, or safety advice and does not by itself establish compliance with OSHA or any other standard. SteelToeTools assumes no liability for its use. Nothing you type is sent to our servers.

How to use this matrix

  1. 1
    Write your scale once, then stop changing it. The five severity levels and the five likelihood levels are yours. The value of a matrix is that two people scoring the same job land in roughly the same place, and that this year's assessment can be compared with last year's — both of which die the moment the wording drifts.
  2. 2
    Score severity on the realistic worst outcome, not the usual one. A dropped wrench from the second level and the same wrench from the eighth floor are one hazard with two severities. This is where most assessments quietly understate themselves.
  3. 3
    Score likelihood for this job, this crew, this season. Not the industry, not the textbook. If it has happened twice on this task in the last year, it is not rare, whatever the manual says.
  4. 4
    Use the controls that are actually in place for the initial score. Not the procedure that exists on paper. If the tag lines are in the truck, they are not a control.
  5. 5
    Reach as high up the hierarchy as you can before you re-score. Elimination, substitution, engineering, then administrative controls, then PPE. A residual score that dropped because of a reminder and a hi-vis vest has not dropped.
  6. 6
    Give every additional control an owner and a date, then verify it. The residual score is a forecast until someone has been out and confirmed that the control is in place and working. Until then the live number is the one in the left-hand column.

What OSHA actually says about risk assessment

Federal OSHA does not publish a risk matrix. It does not define severity levels, likelihood levels, a score, or a threshold at which work may proceed, and no OSHA standard requires you to produce a risk assessment in this form. Anyone telling you their 5×5 grid is “the OSHA matrix” is selling something.

What OSHA does say is in its Recommended Practices for Safety and Health Programs, and it is three sentences long. Characterize the hazards you have found by “considering the severity of potential outcomes, the likelihood that an event or exposure will occur, and the number of workers who might be exposed.” Use interim control measures to protect workers until more permanent solutions are in place. And then the sentence that has to be quoted in full, because it is what keeps a matrix honest:

“Prioritize the hazards so that those presenting the greatest risk are addressed first. Note, however, that employers have an ongoing obligation to control all serious recognized hazards and to protect workers.”OSHA 3885, Recommended Practices for Safety and Health Programs

A matrix is a queue, not a permit. The numbers decide what gets fixed on Monday and what gets fixed in the quarter; they never decide that a serious hazard gets to stay because it scored an eight.

Where each part of this sheet comes from
On the sheetSource
Severity of potential outcomes, likelihood, and the number of workers exposedOSHA 3885, Hazard Identification and Assessment, action item 6
“Risk is the product of hazard and exposure” — risk falls by controlling the hazard or by reducing exposureOSHA 3885, same action item, note
Interim controls while the permanent fix is developedOSHA 3885, Hazard Prevention and Control, action items 2 and 3
The level-of-control column: elimination, substitution, engineering, administrative, PPEHierarchy of controls (NIOSH), reproduced in OSHA 3885
An owner, a target completion date, and a plan to verify effectivenessOSHA 3885, hazard control plan, action item 3
Review at least annually and when conditions, processes or equipment changeOSHA 3885, hazard control plan
Workers on the assessment teamOSHA 3885, Worker Participation, action item 4
On construction: inspections by a competent person feed the assessment29 CFR 1926.20(b)(1)-(2)

The hazard assessments OSHA does require in writing

A general-purpose risk matrix is voluntary. A handful of specific assessments are not, and they have their own required contents — this sheet does not replace any of them. The PPE hazard assessment of 29 CFR 1910.132(d) must be a written certification identifying the workplace evaluated, the person certifying, the date, and the document itself as a certification of hazard assessment. Process hazard analyses under 1910.119(e), permit-required confined space evaluations under 1910.146(c), and the excavation competent person's determinations under subpart P all stand on their own.

Published severity and likelihood scales exist in ANSI/ASSP Z590.3 (prevention through design) and in the U.S. defense standard MIL-STD-882E, and many corporate matrices are adapted from them. They are named here and not reproduced: the ANSI standard is copyrighted, and in any case a scale only works when it is written for the work you actually do.

Frequently asked questions

No. Federal OSHA publishes no risk matrix, no severity scale, no likelihood scale and no acceptable score, and no standard requires you to produce one. What OSHA's recommended practices ask is that you evaluate each hazard by the severity of the potential outcomes, the likelihood that the event or exposure will occur, and the number of workers who might be exposed, then prioritize. A matrix is one common way of writing that down. The few hazard assessments OSHA does require in writing — the PPE assessment of 1910.132(d), for example — have their own contents and are not this document.

Because there is no official wording, and pretending otherwise would be the worst thing this tool could do. Published scales exist — ANSI/ASSP Z590.3 and the defense standard MIL-STD-882E are the ones most often borrowed — but they are written for their own contexts and the copyrighted ones cannot be reproduced here. The boxes come prefilled with plainly descriptive examples so the sheet is usable immediately. Replace them with the definitions your company actually uses, and keep them identical across assessments so two people scoring the same job land in the same place.

That is your organization's decision, written into your program, not something a website can tell you. What is not a matter of opinion: OSHA's guidance states that employers have an ongoing obligation to control all serious recognized hazards, whatever the priority order says. A matrix ranks what you deal with first. It does not authorize work, and it does not turn a serious hazard into an acceptable one by arithmetic.

Both, and that is why the sheet has two columns. Score the initial risk with the controls that are genuinely in place today — not the ones in the procedure that nobody uses — so the number describes reality. Then score the residual risk assuming the additional controls in the next column are actually implemented. The gap between the two is what the assessment is buying, and the residual score is only real once someone has verified that the control is in place and working.

It decides what you put in the additional-controls column. Elimination and substitution physically remove or replace the hazard; engineering controls isolate people from it; administrative controls change the way people work; PPE protects the individual and is last. A row whose only additional control is PPE or a reminder is a row that will score the same next year, because nothing about the job changed.

The people who do the work, with someone who can authorize the fix. OSHA's recommended practices ask employers to have workers participate in inspections and hazard analysis and to involve them in finding solutions — and on a construction site the inspections behind it are the competent person's, under 1926.20(b)(2). An assessment written alone at a desk scores the job as it is imagined, not as it is run.

At least annually, and whenever the conditions, the process or the equipment change — that is the cadence OSHA's hazard control plan guidance uses. Add the trigger events to the review box: a new material, a new machine, a new crew, a near miss, an incident, a change of season on outdoor work.

No. The matrix is built in your browser and the PDF is generated on your device. A draft stays in this browser until you clear it.

Sources & references

Content checked against these sources — last reviewed September 14, 2026.

By — Editorial team of SteelToeTools.com (published by LSEA SAS) Updated v1