5.2 Risk Assessment, Risk Matrix & ALARP Basics

Key Takeaways

  • Risk is commonly expressed as Risk = Likelihood × Severity (how likely harm is multiplied by how bad the consequences would be).
  • Qualitative risk matrices plot likelihood against severity on a grid so teams can classify risk as low, medium, or high and prioritise action.
  • Residual risk is the risk that remains after controls are applied; assessment should consider both initial and residual risk.
  • ALARP (As Low As Reasonably Practicable) means reducing risk until further reduction would be grossly disproportionate to the benefit—Level 1 awareness, not full legal analysis.
  • Stop work and escalate when risk is intolerable, controls are missing or failed, or conditions change beyond the assessment.
Last updated: July 2026

5.2 Risk Assessment, Risk Matrix & ALARP Basics

Once hazards and effects are identified (HEMP Step 1), you must assess risk (HEMP Step 2). Assessment turns a long hazard list into a priority list: what must be controlled before work starts, what can be managed with standard rules, and what is intolerable until conditions change. For ISPON HSE Level 1, master the formula Risk = Likelihood × Severity, the idea of a risk matrix, residual risk, basic ALARP awareness, and stop-work / escalate rules.

Risk = Likelihood × Severity

Risk is not the same as hazard. A hazard is the source of potential harm. Risk describes how big the problem is in practice, combining:

  • Likelihood (probability) — how often or how probable it is that the hazard will cause the unwanted event
  • Severity (consequence) — how bad the effects would be if the event occurred (injury, ill health, fatality, environmental damage, major asset loss)

In words used across Nigerian training rooms:

Risk = Likelihood × Severity

Implications you must understand:

  1. A rare event with catastrophic severity can still be high risk (for example, major hydrocarbon fire).
  2. A frequent event with minor severity can be medium risk and still deserve controls (for example, repeated minor cuts from poor housekeeping).
  3. Reducing either likelihood or severity reduces risk; the best programmes often reduce both.
ComponentQuestions assessors askExample factors
LikelihoodHow often could this happen here?Exposure frequency, condition of equipment, competence, history of near misses
SeverityHow bad if it happens?Energy level, number of people exposed, toxicity, fire/explosion potential, environmental sensitivity

Qualitative Risk Assessment

At Level 1, risk assessment is usually qualitative or semi-quantitative: people use words and simple scores (low/medium/high or 1–5 scales), not complex probabilistic models. A typical simple process:

  1. Describe the task and location.
  2. List hazards and who/what could be harmed.
  3. Estimate likelihood without adequate controls (initial risk).
  4. List existing and planned controls.
  5. Estimate residual risk after controls.
  6. Decide: proceed, add controls, or stop/escalate.
  7. Record and communicate (toolbox talk, JSA, permit).

Assessment should be team-based when possible. Operators and craft workers often know real failure modes that a desk-only assessment misses—especially on Nigerian sites where conditions change with weather, contractor mix, and production pressure.

The Risk Matrix

A risk matrix is a grid with likelihood on one axis and severity on the other. Each cell is coloured or labelled (for example green/yellow/red or low/medium/high) to show risk level. Matrices help teams:

  • Compare different hazards on a common scale
  • Agree when risk is acceptable with controls
  • Show supervisors and clients why extra barriers are needed
  • Train new workers on what "high risk" looks like

Companies use different sizes (3×3, 4×4, 5×5). Learn the logic, not one company's exact colour rules. On exam day, apply the matrix you are given in the question stem.

Simple 5×5 Matrix Example (Illustrative)

Likelihood scale (example):

ScoreLikelihood labelMeaning (plain language)
1RareMay occur only in exceptional circumstances
2UnlikelyCould occur sometime, but not expected often
3PossibleMight occur at some time under current conditions
4LikelyWill probably occur in most circumstances if unchecked
5Almost certainExpected to occur frequently without control

Severity scale (example):

ScoreSeverity labelTypical consequence band
1NegligibleFirst aid only; trivial environmental effect
2MinorMedical treatment; limited local impact
3ModerateLost-time injury; moderate spill or damage
4MajorPermanent disability / serious injury; major spill
5CatastrophicFatality / multiple fatalities; disaster-level release

Illustrative risk score = Likelihood score × Severity score (range 1–25):

L \ S1 Negligible2 Minor3 Moderate4 Major5 Catastrophic
5 Almost certain510152025
4 Likely48121620
3 Possible3691215
2 Unlikely246810
1 Rare12345

Example banding (site-specific; for learning only):

Score bandRisk levelTypical action
1–4LowMonitor; standard controls and good housekeeping
5–9MediumSpecific controls required; supervisor awareness
10–16HighSenior review; robust controls before work; consider stop
17–25Extreme / intolerableDo not proceed until risk reduced; escalate

Worked example: Working in an unsupported deep excavation.

  • Severity if collapse occurs: 5 (catastrophic)
  • Likelihood without shoring/battering and controls: 4 (likely) on unstable soil after rain
  • Initial score: 4 × 5 = 20 (extreme) → do not enter; engineer controls first
  • After proper shoring, access control, and inspection: likelihood drops to 1–2 → residual score much lower, work may proceed under permit and supervision

Residual Risk

Initial (inherent) risk is the risk before additional controls (or with only weak existing controls). Residual risk is what remains after controls are applied. No real workplace has zero residual risk. The goal is residual risk that is tolerable under company standards and ALARP thinking.

ConceptMeaningLevel 1 question
Initial riskRisk picture without adequate controls"How bad is it if we do nothing extra?"
ControlsBarriers that reduce L and/or S"What will we put in place?"
Residual riskRisk left after controls"Is it now low enough to proceed?"

If residual risk is still high or extreme, add stronger controls or do not do the task that way. PPE alone rarely turns extreme risk into low residual risk for high-energy hazards.

ALARP at Level 1 Awareness

ALARP means As Low As Reasonably Practicable. It is a risk-management principle: keep reducing risk until the cost, time, and effort of further reduction would be grossly disproportionate to the extra safety benefit gained. At Basic HSE depth, know these points:

  • ALARP does not mean "as low as we can afford this week if we are in a hurry."
  • ALARP does not mean zero risk or absolute safety.
  • ALARP does mean serious, proportionate effort—especially for high-severity hazards.
  • Documented assessment, hierarchy of controls, and competent judgement support ALARP decisions.
  • For Level 1 workers, the practical translation is: use effective controls that are reasonable for the risk; do not accept high residual risk just because fixing it is inconvenient.

You are not expected to perform full cost-benefit legal arguments on the exam. You are expected to recognise that "reasonably practicable" implies real effort, not empty paperwork.

When to Escalate and When to Stop Work

Every Level 1 worker should know stop-work authority in spirit: if conditions are immediately dangerous or the assessment is no longer valid, pause the job and call supervision/HSE.

Stop work / do not start when:

  • Risk is assessed as high/extreme and agreed controls are not in place
  • Required permits, isolations, gas tests, or competent persons are missing
  • Equipment is defective (for example damaged lifting gear, broken scaffold components)
  • Weather or process conditions create a new high-severity scenario
  • You are asked to bypass a critical safety device without authorised procedure
  • People are impaired (fatigue, alcohol/drugs) for safety-critical tasks

Escalate when:

  • You cannot reduce residual risk with resources available at crew level
  • There is disagreement about severity (for example possible H₂S, structural instability)
  • A near miss shows controls are weaker than assumed
  • Client, community, or environmental exposure expands beyond the original plan
SituationWorker action
Controls match the JSA/permit and residual risk is acceptableProceed with vigilance
Condition changes mid-taskPause, reassess, update controls
Pressure to "just finish quickly" without barriersStop and escalate; production does not override life safety
Unsure about gas test or isolation statusTreat as unsafe until competent confirmation

Common Exam Traps

  • Treating a hazard as already a quantified risk without likelihood and severity thinking
  • Assuming low likelihood always means low risk even when severity is catastrophic
  • Forgetting residual risk after naming controls
  • Confusing ALARP with "ignore expensive controls forever"
  • Continuing work when the matrix would show intolerable risk

Exam Focus

You will see formula items (Risk = Likelihood × Severity), matrix interpretation (which cell is higher risk), residual-risk scenarios, and ALARP definitions at awareness level. Link assessment back to HEMP: assessment prioritises where Control and Recover effort must go.

Test Your Knowledge

In Basic HSE risk language, which expression correctly describes risk?

A
B
C
D
Test Your Knowledge

What does residual risk mean after a risk assessment?

A
B
C
D
Test Your Knowledge

A scaffold crew arrives and finds edge protection missing on a high platform. The matrix would rate an unmitigated fall as high/extreme severity. What is the correct Level 1 response?

A
B
C
D