The NHS 5 × 5 Risk Matrix, Explained Step by Step
How the 2008 NPSA model, as one NHS trust reproduces it, turns how bad and how likely into a score from 1 to 25 and a colour.
The four register entries are example risks written for this page. Every descriptor, frequency anchor and cell colour is taken from East London NHS Foundation Trust's published risk grading matrix, which the trust describes as based on the NPSA risk matrix model. It shows how one trust reproduces the 2008 model, not current national NHS policy.
Every risk gets two numbers from 1 to 5: how bad it would be, and how likely.
The matrix asks two questions about any risk and answers each with a whole number from 1 to 5. Consequence says how bad the outcome would be, from negligible to catastrophic. Likelihood says how probable it is, from rare to almost certain. The running example on this page is a ward that runs below safe staffing for more than a day: consequence 3, moderate, and likelihood 4, likely.
A consequence of 3 means a moderate injury, or a £10,000 to £100,000 claim: one scale, many domains.
The trust's table gives each consequence level written descriptors in nine domains, from harm to patients, staff or public through complaints, staffing, statutory duty, reputation, business objectives and finance to service interruption and the environment. Level 3, moderate, reads as a moderate injury requiring professional intervention, a claim between £10,000 and £100,000, or local media coverage with a long-term reduction in public confidence. Different units, one severity score.
Likelihood is anchored to frequency: rare is 1 in 100 years, almost certain 1 in 4 days.
Each likelihood level carries a plain description and a rough frequency. Rare will probably never happen, about 1 in 100 years; unlikely is 1 in 10 years; possible 1 in 1 year; likely 1 in 1 month; almost certain 1 in 4 days, about 91.3 times a year. Each step up the scale is roughly tenfold more frequent, yet the score rises by only one.
The score is the product: 3 × 4 = 12, on a scale from 1 to 25.
Multiply consequence by likelihood and every one of the 25 cells gets a score, from 1 where negligible meets rare to 25 where catastrophic meets almost certain. The staffing example lands on 3 × 4 = 12. All 25 products computed here match the trust's printed grid, which carries a warning underneath: the scores are not intended to be a precise mathematical measure of risk.
The trust colours cells, not score ranges: a 10 is red when catastrophic, amber when minor.
The printed grid uses three colours: 8 green cells, 10 amber and 7 red. Green holds scores 1 to 4, and every score of 15 or more is red. But the colour belongs to the cell, not to a score threshold: 10 is red at catastrophic and unlikely (5 × 2) yet amber at minor and almost certain (2 × 5). The appendix names no bands and states no thresholds.
Add instead of multiply and the order flips: catastrophic-but-rare scores 6, ahead of minor-but-possible at 5.
Swap the product for a sum and the scale shrinks to 2 to 10. Catastrophic but rare now scores 6 and outranks minor but possible at 5; multiplied, it is 5 against 6. Only 4 of 300 cell pairs swap order, but ties rise from 12 to 30 pairs, and the gap between a rare catastrophe and an almost-certain moderate harm narrows from 5 against 15 to 6 against 8.
Only 14 of the 25 scores can occur; 7, 11, 13 and eight more are never products.
Two whole numbers from 1 to 5 multiply to only 14 different scores. The other 11, namely 7, 11, 13, 14, 17, 18, 19, 21, 22, 23 and 24, cannot occur at all. Above 13 only 15, 16, 20 and 25 exist, so the top of the scale is sparse, while a score of 4 can be reached in 3 ways. On this matrix, a risk logged at 18 points to an arithmetic slip.
Four example risks, one register: the red 10 ranks above the amber 12, colour first, then score.
Four example risks written for this page, scored with the trust's descriptors. A failure that has an MP asking questions in the House, catastrophic but unlikely, scores 5 × 2 = 10: red. Unsafe staffing, 3 × 4 = 12, is amber, as are minor injuries almost certain to recur, 2 × 5 = 10. A records outage over 8 hours, 2 × 2 = 4, is green. Sorted by colour then score, the red 10 leads.
Sources: East London NHS Foundation Trust: Appendix 6, Risk Grading Matrix (based on the NPSA risk matrix model), PDF · Slidelegend briefing: A Risk Matrix for Risk Managers (National Patient Safety Agency, 2008)