Posted By cara We use a risk matix where Liklihood runs 1-5 (1 = Rare, 5 = Certain) Severity also runs 1-5 (1 = Insignificant, 5 = Catastrophic)

Posted By Chris Packham May I suggest that there is no such thing as zero risk. It is like saying we have measured nothing (rather than detected nothing at the lowest level of detection possible)! Even if you cannot detect or determine any risk, there may be one you haven't thought about. The world is full of incidents where someone said before hand: "That could never happen". Could you ever be confident that you had identified all the potential ways in which a system might fail, particularly if you are relying upon people to operate it? Chris

Posted By Tabs You may, I would suggest, decide that the risk is so small as to be zero - but you would not then record it because the idea is to record *significant* findings, not the very very remote. Starting at 1 is appropriate and is where the vast majority of systems start. Anything you are tempted to put as zero, should not appear on your assessment really, should it?

Posted By Rob T Tabs is spot on! If something is a zero (or even if you get something like a 1 x 1 = 1) it shouldn't appear on your final risk assessment as it is insignificant. You only have to record significant risks.

Posted By Ian Waldram Whilst I agree with points made above about zero, it's also important to realise that the number coming from a matrix CANNOT be interpreted mathematically, i.e. a matrix figure of 4 DOESN'T mean the risk is 4 x worse than a figure of 1. All the ratings are essentially subjective, so it's a qualitative process. Because it is so, there's little added value in having lots of ratings - it tends only to lead to arguments among the risk assessment team. Thus a 4x4 or 5x5 is ample for most applications, as it's only a simple tool to help prioritise resources towards reducing the higher risks first. Quantified risk assessment can be done in some circumstances, but it requires statistically valid data about failure rates, consequences, etc. To be carried out only by specialists, and even then results interpreted with considerable caution!

Posted By Adrian Watson Dear All, As my views are well known regarding risk matrices, I'll refrain from making comments other than recommending that you use a 4 x 4 square as this prevents people from sitting on the fence when carrying out risk assessments. Regards Adrian

Posted By Peter Leese Adrian - I reckon you enjoy dancing on pin heads!

Posted By J Knight Just got two points on this. First of all the original unreconstructed version of Managing Safely uses a matrix with zeros. The accompanying notes explain that the use of a zero doesn't mean no likelihood or no harm whatsoever, just a vanishingly small one. It is intended to thoroughly weed out utterly trivial risks. Not saying whether I agree, but this may be where the matrix in question is derived from. and interestingly the new MS has a more normal matrix scored 1 to 5. The second point, and with some relevance to another current thread, is that HSE's sample RAs on their Risk Management site have no numbers in them at all. To which I say, about time. Risk matrices, where the numbers have no objective meaning, are a waste of time in my opinion, and we only use one because I can't persuade people like the Care Commission and our Insurers that they don't help and are just another hurdle for most managers, John

Posted By Chris Jerman You have to go back to basics here - what do you want from risk assessment? If you're a small firm, then numbers really are not necessary. But once you get into multi site etc, then the numbers mean everything. How do you make risk management decisions if you don't know how the assessment conclusion has been derived. I use a 3x3 because that's what I taught on the IOSH General Risk Assessment course for four years and it works. Remember the HSE never said turn this into a science - unless you need a scientific risk assessment. 3x3 is good as you can define the outer ends very clearly and the middle is what's left by exclusion. Remember that you don't need to provide space for insignificant as has been said - but anyway you should be plotting the reasonably foreseeable worst case injury ie that which you could reasonably predict as being the anticipated maximum in the context of the task. Motorway car crash - fatality, valet parking car crash - minor soft tissue damage? The task drives the whole context. If managers are expected to make risk management decisions based on priority there has to be some way of rationalising the problem. Remember risk management and safety management are totally different doctrines. Risk management is not the application of controls - it's the decision process that leads us to the order in which we apply controls. OK example taking a 3x3. There are for 3 ways to hit medium - 1x3, 2x2 and 3x1. They mean very different things. 1 x 3 = minor injury at reasonable worst whilst performing the task, with a high likelihood of it going wrong when we do it. OK - fix the likelihood then, better controls. There's little to be served by attacking the hazard. Remember - this is for managers who don't want to be safety pros! 3 x 1 is very different. OK really bad news if it goes wrong, but the assessment shows that likelihood is looking pretty good - so I can ignore it? Not likely, now we're into controls assurance. The manager has to ask 'what keeps that likelihood low?' because if it slides, the risk value's next stop is high (ie 3x =2 or worse still 3x3) If controls are as sound as a pound then maybe I can move onto the next issue. But I still want some checks in place Probability is not synonymous with likelihood. All of this rare, seldom nonsense doesn't work. How would you assess a task that you'd never done before? Low likelihood equates to we do this pretty well, high equates to we're shocking at this and if it's neither then well, it could be worse, but it could be a lot better. Deciding factors would include competency, effectiveness of current controls, environment,etc etc. CAT 1 responders have to use 5x5 and that's fine because they have to plot domestic ie internal risk and external risk eg terrorism. One bloke falling through a roof cannot be placed on the same line as half of London being blown up. So usually domestic hazard stops at 4. This does work - we have nearly 70,000 employees we'd have noticed if it didn't.

Posted By David Bramall Simon If you must use a risk matrix at least leave out the zero. Personally I dont use a matrix; I use the operation analysis and control method (www.web-safety.com) whereby we minimise / eliminate / control all hazards so the risk is automatically "controlled" for want of a better word. The matrix only really applies where priorities need to be set to control the "BIG ONES" DrB