Free tool
Risk assessment matrix — Malaysia
Rate each risk for likelihood and impact on a 5x5 grid, see where it lands on a heat map, and keep the register beside it. The default bands are the ones in Malaysia’s own DOSH HIRARC guideline, and you can switch them.
- 0 Low
- 4 Medium
- 2 High
Highest first
- 16Key supplier delivers late (High)
- 15Authority approval is delayed (High)
- 12Scope grows after sign-off (Medium)
What each band asks for
- Low 1–4
- Acceptable. Further reduction may not be necessary.
- Medium 5–12
- Needs a planned approach to control it.
- High 15–25
- Needs immediate action before the work goes ahead.
| Risk | Likelihood | Impact | Score | Owner | Response | Remove |
|---|---|---|---|---|---|---|
1 | 16High | |||||
2 | 12Medium | |||||
3 | 15High | |||||
4 | 8Medium | |||||
5 | 10Medium | |||||
6 | 6Medium |
Nothing you type is sent anywhere or saved. Download or copy before you close the page.
Risk assessment matrix example — six project risks
The example loaded above is six risks a project might carry. Each score is likelihood times impact: the late supplier is 4 × 4 = 16, the approval delay is 3 × 5 = 15, the scope growth is 4 × 3 = 12, and so on down to the weather risk at 3 × 2 = 6.
Under the DOSH bands, two of the six are High (16 and 15) and four are Medium. Switch to the four-band layout and the same six risks become four High and two Medium. Nothing about the risks changed; only where the line was drawn. That is why the bands should be agreed before anyone starts scoring, not after.
What is a risk assessment matrix?
A grid that puts two ratings against each other: how likely a risk is, and how much it would matter if it happened. Multiply the two and you get a score, and the score places the risk in a band such as Low, Medium or High. The band tells you how much attention it needs.
Its value is comparison. It lets a team look at a long list of risks and agree which few need action first, without arguing each one from scratch.
How to use a 5x5 risk matrix, step by step
- List the risks. Write each as an event that could happen, such as “key supplier delivers late”, not a worry such as “supply chain”.
- Rate likelihood, 1 to 5. From Inconceivable to Most likely. Base it on experience and evidence where you have it, not on how worried it makes you.
- Rate impact, 1 to 5. From Negligible to Catastrophic, against what matters on this project: time, cost, quality, safety or reputation.
- Read the score and band. The tool multiplies and places it on the heat map.
- Decide the response. Reduce it, move it, accept it or stop doing the thing that creates it, and write down what you will do.
- Give each risk an owner and revisit the list. A risk register nobody reopens goes stale quickly.
Malaysia’s risk assessment matrix: DOSH HIRARC
Malaysia’s Department of Occupational Safety and Health publishes a 5x5 matrix in its Guidelines for Hazard Identification, Risk Assessment and Risk Control (HIRARC), 2008. Risk is likelihood times severity, each rated 1 to 5, and the guideline sets three bands:
- 15 to 25, High. Needs immediate action, documented with a completion date.
- 5 to 12, Medium. Needs a planned approach to controlling it.
- 1 to 4, Low. May be considered acceptable. If it can be resolved quickly and efficiently, the guideline says to do so and record it.
This tool starts on those bands, with the guideline’s likelihood scale: Inconceivable, Remote, Conceivable, Possible, Most likely. That keeps your matrix consistent with the regulator’s if you also run workplace hazard assessments.
One difference to know about. HIRARC is a workplace-safety guideline, and its severity scale describes injury: Negligible is a first-aid injury, and Catastrophic is numerous fatalities. This tool’s impact scale is deliberately generic so it suits project risk. If you are completing an actual HIRARC assessment, take your severity rating from DOSH’s own table, not from the impact labels here.
Risk assessment matrix template in Excel
Copy register as a table puts the register on your clipboard tab-separated, so it pastes into Excel, Google Sheets or Word as a real table, with the score and rating already worked out. Download as CSV gives you the same as a file that opens directly in Excel. The matrix itself downloads as an image for slides and reports.
What a risk matrix cannot tell you
The scores are labels for ordering, not measurements. A 12 is not twice as serious as a 6; it only ranks higher. Two risks can share a score and still need very different responses: a rare catastrophe and a frequent nuisance both come out near the middle.
It also depends on who does the rating. Two people can place the same risk in different cells and both be reasonable, which is why it works best as a conversation rather than a calculation. When the question is how much money a risk is worth, use a number instead: the risk calculator works out expected monetary value for each risk and in total.
Tools to use alongside your risk assessment matrix
- Project charter template — record the key risks alongside the scope, budget and dates.
- RACI matrix generator — decide who owns each response.
- Gantt chart generator — see which risks threaten the critical path.
- Cost calculator — three-point estimates and contingency.
Questions
›What is a risk assessment matrix?
A grid that rates each risk by how likely it is and how much it would matter, then multiplies the two into a score. The score places the risk in a band such as Low, Medium or High, which tells you how much attention it needs.
›How do you write a risk matrix?
List the risks as events that could happen. Rate each one for likelihood and impact from 1 to 5, multiply them, and read the band. Then record an owner and a response for each. The tool above does the multiplying and draws the heat map.
›How is the risk score calculated?
Likelihood times impact. On a 5x5 matrix both are rated 1 to 5, so scores run from 1 to 25.
›What are the Low, Medium and High bands in Malaysia?
In the DOSH HIRARC guideline, 2008, 15 to 25 is High, 5 to 12 is Medium and 1 to 4 is Low. This tool uses those as its default.
There is no single universal set of bands. Organisations choose their own, and the tool also offers a four-band layout with an Extreme tier.
›What does HIRARC stand for?
Hazard Identification, Risk Assessment and Risk Control. It is the name of the guideline DOSH published in 2008 for assessing hazards at work.
›Does it have to be 5x5?
No. Smaller grids such as 3x3 are used too. DOSH’s guideline illustrates a 5x5.
›Can I change the rating bands?
Yes, between the two layouts offered. Whichever you choose, agree it before scoring, because the same risks can fall into different bands under different layouts.
›Is my risk register saved?
No. It is built in your browser and nothing is sent anywhere, so it is gone when you close the page. Download or copy it first.
Get a quote
Tell us your team size, timeframe and whether you pay the HRD Corp levy. Within one working day you get a day rate, a suggested course shape and how to claim it through HRD Corp.