A risk assessment matrix is a scoring table that turns a hazard identification into a prioritised control decision. It is not a calculator and it does not remove judgment from the process — it structures that judgment so two people looking at the same hazard land on comparable scores, and so a lab has a documented, defensible basis for deciding what gets fixed first. In a research lab, the matrix is usually the second step in a process that starts with a hazard identification exercise (often called a job hazard analysis) and ends with a documented, re-scored residual risk after controls are applied.
OSHA does not mandate a specific matrix format. The Occupational Safety and Health Act’s General Duty Clause and the Laboratory Standard (29 CFR 1910.1450, which requires every lab covered by it to maintain a chemical hygiene plan) both require that hazards be identified and addressed, but neither prescribes how severity and likelihood must be scored. The 5×5 severity-times-likelihood matrix used below is the most common convention in institutional environmental health and safety (EHS) practice — not a regulatory requirement — and many institutions adapt the exact wording of their severity/likelihood levels to their own hazard mix. Check your own institution’s chemical hygiene plan, biosafety manual, or EHS risk-assessment procedure before assuming the scale below is the one your institution uses; treat it as a working template, not a mandated standard.
What the matrix scores, and what it doesn’t
The matrix scores two independent dimensions for a single, specific hazard scenario — not a whole procedure, not a whole lab:
- Severity — how bad the worst reasonably foreseeable outcome is if the hazard is realised.
- Likelihood — how probable that outcome is, given current conditions and controls (or lack of them).
Multiplying the two numeric scores gives a risk score that ranks hazards against each other, so limited safety budget and attention go to the highest-scoring items first. The matrix does not tell you whether an activity is “safe” in any absolute sense, and it is not a substitute for consulting the actual regulatory or manufacturer requirements that apply to a given hazard (a laser’s control measures, for example, are set by its laser hazard class, not by wherever it happens to land on a generic matrix).
Building the severity scale
Severity should be defined in terms a bench scientist can apply consistently, anchored to realistic worst-case outcomes for a research lab rather than a generic industrial-safety wording. A typical five-level lab-specific severity scale:
| Score | Level | Lab-specific definition |
|---|---|---|
| 1 | Negligible | No injury, or first-aid-only injury with no lost time; no reportable exposure; no property/equipment damage beyond routine wear. |
| 2 | Minor | Minor injury requiring medical treatment beyond first aid but no hospitalization (e.g., a superficial chemical burn, a minor cut); brief, reversible exposure with no lasting effect; localized, low-cost equipment damage. |
| 3 | Moderate | Injury or exposure requiring hospitalization or specialist follow-up but expected to be fully reversible (e.g., a splash requiring emergency eyewash and ophthalmology follow-up); a reportable occupational exposure; significant equipment loss. |
| 4 | Major | Serious injury with potential for permanent impairment (e.g., permanent vision loss from an unshielded laser exposure, a deep cryogenic burn); an exposure with a real risk of long-term or irreversible health effect. |
| 5 | Catastrophic | Death or life-threatening injury/illness to one or more people; a release with potential to affect people beyond the immediate work area (e.g., systemic toxicity from a hazard like concentrated hydrofluoric acid, an uncontrolled biological release at a significant biosafety level). |
Building the likelihood scale
Likelihood should reflect the probability of the specific severity outcome occurring under current conditions — not the probability that the hazard exists at all. A typical five-level scale:
| Score | Level | Lab-specific definition |
|---|---|---|
| 1 | Rare | Would only occur in exceptional circumstances; no known occurrence in this lab or comparable labs doing this work. |
| 2 | Unlikely | Could occur but is not expected under normal conditions; occurs infrequently across comparable labs. |
| 3 | Possible | Could occur at some point; has happened occasionally in this lab or comparable labs. |
| 4 | Likely | Will probably occur in most circumstances; has occurred more than once in this lab. |
| 5 | Frequent / Almost certain | Expected to occur in most performances of the task; occurs routinely without intervention. |
The scoring grid
Risk score = severity x likelihood, giving a value from 1 to 25. Most institutional EHS programs band the resulting score into four action tiers. There is no single regulatory-mandated banding — the specific cut points below are a common convention, and your institution’s EHS office may draw the lines differently:
| Score range | Band | Typical action |
|---|---|---|
| 1-4 | Low | Acceptable with routine controls already in place; document and review on the standard SOP review cycle. |
| 5-9 | Medium | Acceptable only with specific additional controls in place and documented; review more frequently (e.g., annually or at protocol renewal). |
| 10-16 | High | Work should not proceed until additional controls reduce the score, or until a designated safety authority (Chemical Hygiene Officer, Radiation Safety Officer, Biosafety Committee, as appropriate to the hazard) reviews and signs off. |
| 17-25 | Critical | Work stops or does not start until the hazard is eliminated or substituted, or engineering controls bring the score down; sign-off from institutional EHS leadership, not just the PI or lab manager. |
The full grid, with every severity/likelihood combination pre-scored, is worth posting next to the SOP for a hazardous procedure so the scoring is transparent rather than something only EHS staff can reproduce:
| Likelihood ↓ / Severity → | 1 Negligible | 2 Minor | 3 Moderate | 4 Major | 5 Catastrophic |
|---|---|---|---|---|---|
| 5 Frequent | 5 | 10 | 15 | 20 | 25 |
| 4 Likely | 4 | 8 | 12 | 16 | 20 |
| 3 Possible | 3 | 6 | 9 | 12 | 15 |
| 2 Unlikely | 2 | 4 | 6 | 8 | 10 |
| 1 Rare | 1 | 2 | 3 | 4 | 5 |
Three worked examples
These are illustrative worked examples showing how the scoring is applied, not documented case reports from a specific incident or institution. Each shows the initial score before controls, the controls applied following the standard hierarchy of controls (elimination/substitution first, then engineering, then administrative, then PPE last), and the residual score after controls.
Example 1: Small-volume hydrofluoric acid transfer for etching
- Severity: 5 (Catastrophic). Concentrated hydrofluoric acid can cause deep tissue destruction and systemic fluoride toxicity — including cardiac effects — from a skin contact area as small as the palm of a hand if not treated immediately, and effects can be delayed in onset.
- Likelihood before controls: 3 (Possible). Occasional small-volume transfers by trained staff, but with no engineering controls and single-person handling.
- Initial score: 15 (High).
- Controls applied: dedicated ventilated enclosure for transfers, secondary containment, mandatory two-person rule, calcium gluconate gel and a specific HF first-aid protocol posted and stocked at point of use, hazard-specific SOP and sign-off before independent work.
- Likelihood after controls: 2 (Unlikely).
- Residual score: 10 (still High). A Catastrophic severity hazard rarely drops out of the High band through likelihood reduction alone — this is expected and correct: the residual score being lower but still elevated is the signal that ongoing, elevated-level sign-off (not just a one-time SOP approval) is appropriate for this specific hazard, consistent with the sign-off guidance in the scoring grid above.
Example 2: Open-beam alignment of a Class 4 laser
- Severity: 4 (Major). Direct or reflected beam exposure during alignment can cause permanent retinal damage.
- Likelihood before controls: 4 (Likely). Manual alignment work routinely involves the operator’s eyes near beam height with the enclosure open.
- Initial score: 16 (High).
- Controls applied: wavelength- and optical-density-rated laser safety eyewear, alignment performed at reduced power where the system allows it, beam path enclosure wherever alignment doesn’t require it open, interlocked access to the room, and a laser-safety-officer-approved SOP specific to the alignment step.
- Likelihood after controls: 2 (Unlikely).
- Residual score: 8 (Medium).
Example 3: Liquid nitrogen dewar transfer in a small, poorly ventilated room
- Severity: 4 (Major). A large release in an unventilated space can displace oxygen to unsafe levels quickly and without warning (nitrogen is odourless and colourless), in addition to cold-contact burn risk; see cryogen handling safety for the underlying hazard mechanisms.
- Likelihood before controls: 3 (Possible). Routine transfers, no oxygen monitoring, standard room ventilation only.
- Initial score: 12 (High).
- Controls applied: fixed oxygen-deficiency monitor with audible alarm in the room, transfers relocated to a room with better ventilation where feasible, cryogenic gloves and face shield, dedicated transfer cart, and restricting independent transfers to trained personnel only.
- Likelihood after controls: 1 (Rare).
- Residual score: 4 (Low).
Setting a risk-acceptance threshold
The matrix only does useful work if a hazard’s residual score is compared against a pre-agreed threshold for who may accept it and under what conditions — otherwise a lab can score a hazard honestly and then proceed anyway with no one having actually decided that’s acceptable. A common institutional pattern, though the specific authority names vary:
- Low residual risk: PI or lab manager sign-off is typically sufficient, documented in the SOP itself.
- Medium residual risk: PI sign-off plus review by the relevant safety officer role for that hazard class — a chemical hygiene officer for chemical hazards, a radiation safety officer for radiological hazards, a biosafety officer for biological hazards.
- High residual risk: work does not start (or continue) until the relevant safety committee or officer has reviewed the specific controls and residual score, not just the SOP text.
- Critical residual risk: work is paused until the hazard itself is eliminated, substituted, or brought down through engineering controls — administrative controls and PPE alone are not treated as sufficient at this level.
Whatever thresholds a lab adopts, they should be written down before the matrix is used in anger, not decided case by case after a score comes back higher than someone expected.
Common pitfalls
- Scoring the procedure, not the specific scenario. “Working with acids” is too broad to score meaningfully — score the specific foreseeable failure (a splash during transfer, a spill during dilution) separately.
- Scoring likelihood as if controls already existed, before they’re actually in place. The initial score should reflect current, real conditions — not the conditions a lab plans to have once a control is funded and installed.
- Treating the matrix as precise. A score of 9 versus 10 is not a meaningfully different level of risk; the bands exist so people don’t over-interpret small numeric differences as if the tool were more precise than it is.
- Never re-scoring after controls. The initial score justifies why a control is needed; the residual score is what actually gets compared to the acceptance threshold. Skipping the re-score defeats the point of applying controls at all.
- One matrix score standing in for a hazard-specific regulatory requirement. A laser’s required controls come from its hazard class, a biological agent’s from its risk group and biosafety level, a chemical’s from its GHS classification — the matrix prioritises attention across hazards, it doesn’t replace those hazard-specific requirements.
Frequently asked questions
Is a 5×5 matrix required by OSHA?
No. OSHA’s General Duty Clause and, for labs covered by it, the Laboratory Standard (29 CFR 1910.1450) require hazard identification and a documented chemical hygiene plan, but neither prescribes a specific matrix size or scoring convention. The 5×5 format is a widely used institutional convention, not a regulatory mandate.
What’s the difference between initial risk and residual risk?
Initial risk is the severity x likelihood score under current conditions, before any additional controls are added. Residual risk is the score after those controls are applied — it’s the number that should actually be compared against an acceptance threshold, since it reflects the risk the lab is really operating with.
Can severity ever be reduced by controls, or only likelihood?
Most controls reduce likelihood (better containment, training, PPE make the bad outcome less probable) rather than severity (how bad the outcome is if it does happen). Severity is usually only reduced by eliminating or substituting the underlying hazard — for example, switching from a more to a less toxic reagent, or from an open-beam to a fully enclosed laser system.
Who should be involved in scoring, not just approving the score?
The bench researcher who actually performs the procedure should be part of the initial scoring conversation, not just the final sign-off — they’re the ones who know what actually happens during the procedure, which is often different from what the written protocol describes.
How often should scores be reviewed?
At minimum, whenever the procedure, equipment, personnel, or quantities change, and on a fixed cycle (commonly annually, or at SOP renewal) for anything scored Medium or above, so a control that has quietly stopped being followed doesn’t go unnoticed until an incident.
