Every hazard is scored on two independent axes — how likely it is to occur (1–5) and how severe the consequences would be if it did (1–5). ISO 31000-style risk assessment combines them multiplicatively:
Risk score = Likelihood × Severity (range 1–25)
1–4 Low (green)
5–9 Medium (yellow)
10–15 High (orange)
16–25 Extreme (red)
Each hazard is drawn as a bar on the 5×5 grid — its position is (severity, likelihood), and its height and color track its current score. Reducing either axis moves the bar toward the green corner.
The hierarchy of controls ranks mitigation strategies from most to least effective — always prefer a control higher on the list:
- Elimination — remove the hazard entirely. Risk → 0.
- Substitution — replace with something less harmful. Severity −2.
- Engineering controls — redesign the process/equipment. Likelihood −2.
- Administrative controls — training, procedures, signage. Likelihood −1.
- PPE — the last line of defence, protects the person, not the process. Severity −1.
This is the same matrix and hierarchy used by real occupational-safety and industrial-hygiene programs to prioritise which hazards get attention first and to prove, quantitatively, that a chosen control actually reduced residual risk.