Risk Ratings Explained: What Do Low, Medium and High Really Mean?
Your risk assessment says “medium risk.”
It sounds clear but does everyone in your business understand what that rating means or what they are expected to do next?
Risk ratings can be helpful. They allow businesses to compare risks, identify priorities and decide where further action may be needed. However, a green, amber or red box is only useful when it reflects what is really happening in the workplace.
What does the law require?
UK law requires employers to complete a suitable and sufficient assessment of the risks to employees and other people who may be affected by their work.
The law does not prescribe one particular numbered or colour-coded risk matrix. The important outcome is that you identify hazards, assess how likely and serious the potential harm could be, and take suitable action to eliminate or control the risk.
A risk rating is therefore a tool to support your decision-making—not the purpose of the assessment itself.
Hazard and risk are not the same
A hazard is something with the potential to cause harm.
The risk considers how likely it is that someone could be harmed and how serious that harm could be.
Consider a trailing cable in an office.
A cable secured behind a desk, where nobody normally walks, may present a relatively low risk.
Place the same cable across a busy reception walkway and the situation changes. More people are exposed, someone is more likely to trip and the possible consequences may be more serious.
The hazard is the same, but the level of risk is different.
What does a risk rating tell you?
Many organisations calculate a rating by considering:
Likelihood × Severity = Risk rating
Likelihood asks how realistically the incident or ill health could occur.
Severity considers how serious the reasonably foreseeable harm could be.
Although a matrix can make the process more consistent, judging likelihood still requires knowledge of the activity, available evidence and sensible professional judgement. HSE acknowledges that likelihood can be subjective and may vary between people and industries.
This is why selecting a number should never become a simple tick-box exercise.
Common risk-rating mistakes
Choosing the colour first
It can be tempting to decide that something “looks medium” and then select numbers that produce an amber result.
Instead, describe the hazard, possible harm, people affected, exposure and existing controls before deciding on the rating.
Treating planned controls as completed controls
Writing “staff training will be arranged” does not mean the training is already protecting people.
Do not reduce the residual risk rating until the control has genuinely been introduced and you have checked that it works.
Assuming low risk means no further thought is needed
A low rating may mean the existing controls are effective. Those controls still need to be maintained, communicated and reviewed.
Allowing medium-risk actions to remain unfinished
“Medium” should not become another way of saying “we will look at it eventually.”
Every required action should have a responsible person and a realistic completion date.
HSE’s risk-assessment template prompts businesses to record existing controls, further actions, who will carry them out and when they are needed.
Copying another organisation’s assessment
An example can help you understand the process, but your assessment must reflect your own workplace, employees, activities and controls.
A generic assessment may overlook the details that make the risk higher or lower in your business.
Paula’s practical risk-rating tips
Before accepting a risk rating, ask:
Have we clearly identified the hazard?
Have we explained how someone could be harmed?
Have we considered everyone who may be affected?
Are the existing controls genuinely in place?
Have we spoken to the people who perform the work?
Does the rating reflect normal work and busy or unusual periods?
Is further action needed?
Who will complete it, and by when?
How will we check that it has been completed?
What change, incident or concern would trigger a review?
HSE describes risk management as an ongoing process of identifying hazards, assessing and controlling risks, recording significant findings and reviewing the controls.
The number should lead to action
A completed risk assessment form does not automatically mean the risk has been managed.
The real value lies in what happens next:
Suitable controls are introduced.
Responsibilities are clearly allocated.
Actions are completed.
Employees understand the arrangements.
Controls are checked and reviewed.
Risk assessments should help you make calm, proportionate and informed decisions not create unnecessary paperwork or leave you wondering what an amber box is trying to tell you.
Are your risk ratings helping you make decisions?
Perhaps you have inherited a collection of assessments, but you are unsure whether the ratings are consistent.
Maybe actions have been identified, but nobody is certain which ones should be completed first.
You do not need to struggle through it alone.
Book a free 20-minute online chat with Paula for calm, practical guidance and a clearer understanding of what your business needs to do next.
Paula Santomauro
Your Company Works
📞 07799 533094
✉️ paula@yourcompanyworks.com
Calm, professional, friendly Health & Safety support for busy business people.