The risk matrix is the workhorse of qualitative risk assessment - a simple grid that lets a team turn a scenario into a ranked risk without heavy calculation. It appears in almost every PHA and bowtie review, and its familiarity hides some genuine subtlety about how it is built and where it can mislead. This guide explains how the likelihood-by-consequence matrix works, how its cells map to tolerable and intolerable risk, and the pitfalls of using a matrix that has not been carefully calibrated.
Risk Matrix in one line: A risk matrix is a grid that ranks a hazard scenario by combining how likely it is with how severe its consequence would be. One axis represents likelihood or frequency, the other represents consequence severity, and each cell where they meet is assigned a risk level - typically shown as a colour running from acceptable through tolerable to intolerable. It lets a team prioritise scenarios and decide which need further risk reduction, using judgement rather than detailed calculation.
A risk matrix builds on the basic idea that risk combines likelihood and consequence: a rare event with a small consequence is a low risk, while a frequent event with a catastrophic consequence is a high one. The matrix makes this operational by dividing each dimension into a handful of bands. The consequence axis might run from a minor injury or negligible loss up to multiple fatalities or major environmental and financial damage, with each band described in concrete terms. The likelihood axis runs from something expected to happen occasionally down to something so rare it is barely credible, again with each band anchored to a description or a frequency range.
To rank a scenario, the team places its consequence on one axis and its likelihood on the other and reads off the cell where they intersect. That cell carries a pre-agreed risk level, usually shown by colour: a green cell means the risk is broadly acceptable as it stands, an amber or yellow cell means it is tolerable but should be reduced where reasonable, and a red cell means it is intolerable and demands action. Because the whole team uses the same grid, scenarios across a study are ranked on a consistent scale, which is what lets a review compare very different hazards and decide where to focus.
The strength of the matrix is speed and communicability. It requires no modelling, produces an answer a mixed team can agree on in minutes, and yields a picture that managers and operators can read at a glance. That is why it sits at the heart of qualitative PHA and bowtie work. But the same simplicity that makes it fast is what makes its design so important, because the whole result depends on how the bands are defined and how the cells are coloured - decisions made once, when the matrix is drawn up, and then applied to every scenario.
The colours on a risk matrix are not decoration; they encode a company's risk tolerance. The grid is typically divided into regions that echo the tolerability framework used in process safety: a broadly acceptable region where the risk is low enough that no further action is normally warranted, a tolerable region where the risk is accepted only if it has been reduced as far as is reasonably practicable, and an intolerable region where the risk cannot be accepted and must be reduced regardless of cost. Assigning each cell to one of these regions is what turns the grid from a description into a decision tool.
This mapping determines what happens after a scenario is ranked. A scenario landing in the intolerable region cannot simply be documented and left; it triggers a requirement to add risk reduction until it moves out of that region. A scenario in the tolerable region prompts a search for reasonable further reductions but may be accepted if none are justified. A scenario in the broadly acceptable region generally needs no action. In this way the matrix connects directly to concepts like as-low-as-reasonably-practicable and tolerable risk, giving them a practical form that a review team can apply case by case.
Because the boundaries between regions embody real decisions about acceptable harm, where they are drawn is a governance question, not a drafting detail. Moving a boundary by one cell can reclassify a whole class of scenarios from action-required to acceptable, so the region layout is normally set at an organisational level and applied consistently, rather than adjusted study by study. A matrix whose regions are chosen carelessly can either flag so much as intolerable that the label loses meaning, or tolerate risks the organisation would never knowingly accept.
A risk matrix is only as trustworthy as its calibration, and an uncalibrated matrix can be actively misleading. The most common failure is vague, unanchored bands: if likelihood levels are described only as words like unlikely or possible, different people interpret them differently, and the same scenario gets ranked in different cells depending on who is in the room. The remedy is to anchor each likelihood band to a frequency range and each consequence band to concrete, defined outcomes, so that placing a scenario is a matter of matching evidence to definitions rather than guessing. A well-calibrated matrix reduces the influence of who happens to be assessing.
Other pitfalls are more structural. A matrix can compress a wide range of real risk into a single colour, so two scenarios in the same red cell may actually differ by orders of magnitude, hiding which one deserves attention first. Teams can drift toward the centre of the grid, avoiding the extreme cells, which flattens the ranking. And a matrix that is not tied to any actual frequency data invites optimism, because there is nothing to check a comfortable guess against. These are not reasons to abandon the tool - it remains invaluable for prioritisation - but reasons to treat its calibration as a serious task and to escalate to a more quantitative method where the stakes justify it.
The likelihood axis is where operating data is most useful, because likelihood is exactly what a good frequency record can inform. A historian that has captured how often equipment has actually failed, how frequently a protective trip has been demanded, and how regularly the process has drifted toward an upset gives a review team an evidence base for placing a scenario on the likelihood axis rather than relying on gut feel. Merobix, as cloud SCADA for oil and gas, retains alarm, trip, and process history across many remote sites in one browser, and that record is precisely the raw material a team can use to calibrate the likelihood bands and to justify where a specific scenario sits, making the matrix's ranking more defensible than intuition alone.
A risk matrix has a likelihood or frequency axis and a consequence severity axis. Likelihood ranges from events expected to occur occasionally down to those so rare they are barely credible, while consequence ranges from minor harm up to catastrophic outcomes. A scenario is ranked by finding the cell where its likelihood and consequence meet, and that cell carries a pre-agreed risk level.
Calibrating a matrix means anchoring its bands to concrete definitions so that placement is consistent regardless of who is assessing. Likelihood levels are tied to frequency ranges and consequence levels to defined outcomes, and the colour regions are mapped deliberately to the organisation's risk tolerance. An uncalibrated matrix with vague, wordy bands produces inconsistent rankings because different people interpret the levels differently.
A risk matrix can compress a wide range of real risk into a single cell, so two scenarios coloured the same may differ by orders of magnitude. Vague bands cause inconsistent rankings, teams tend to drift toward the middle of the grid, and a matrix untethered to real frequency data invites optimism. It remains excellent for fast prioritisation, but high-consequence scenarios often warrant a more quantitative method.
Merobix reads your field devices into a cloud SCADA - the real thing behind these terms, live in days from any browser.