JHA / JSA Risk Matrix
Break a job into steps, list hazards, score severity × likelihood, and rank risks on a 5×5 matrix to prioritise control measures.
Break the job into steps, list each hazard, rate severity and likelihood, and the matrix ranks them by risk = severity × likelihood so you can prioritise control measures.
Risk matrix (severity × frequency/likelihood)
| L1 | L2 | L3 | L4 | L5 | |
| S5 | 5 | 10·1 | 15 | 20 | 25 |
| S4 | 4 | 8 | 12·1 | 16 | 20 |
| S3 | 3 | 6 | 9 | 12 | 15 |
| S2 | 2 | 4 | 6 | 8·1 | 10 |
| S1 | 1 | 2 | 3 | 4 | 5 |
·n = number of items on that cell. ≥15 high / 8–14 medium / ≤7 low.
Ranked risk profile
| # | Hazard | Risk | Level | Controls |
|---|---|---|---|---|
| 1 | 机械转动部位夹伤 | 12 | Medium | 防护罩 + 安全联锁 + 禁止戴手套操作 |
| 2 | 高处作业坠落 | 10 | Medium | 作业许可 + 全身式安全带 + 临边防护栏杆 |
| 3 | 搬运重物腰肌劳损 | 8 | Medium | 助力搬运车 + 单人限重培训 |
- The 3 medium-risk item(s) need a permit, a watchman and task-specific training before the job starts.
- Re-score with the same matrix after the controls are in place — close the item only when the residual risk drops to acceptable.
- Re-run the assessment whenever the job steps, equipment, crew or process change.
Serves these standards
About this tool
A job hazard analysis (JHA — also called JSA) is the workhorse of ISO 45001 hazard identification: break a task into steps, list what could hurt someone at each step, and rank the risk before deciding on controls. Clause 6.1.2 makes an ongoing hazard-identification process mandatory, and the JHA is the format that survives audits because it shows the reasoning.
Score each hazard as severity × likelihood and place it on the 5×5 matrix. The ranking decides where controls go first — and the controls follow the hierarchy: eliminate the hazard if you can, then substitute, engineer, use administrative controls, and only then PPE. Registers that jump straight to PPE are a consistent audit finding.
Frequently asked questions
JHA vs JSA vs risk assessment — what is the difference?
They overlap heavily. A JHA/JSA is task-level: one job, broken into steps, hazards per step. A risk assessment (Clause 6.1.2) is broader — processes, sites, emergency situations and routine/non-routine activities. Use the JHA as the building block and roll the results into the wider OH&S risk register.
What is the hierarchy of controls?
The ordered approach to controlling risk: elimination, substitution, engineering controls, administrative controls, and finally personal protective equipment. Higher levels remove the hazard itself; PPE only reduces the consequence when everything else fails. Assessors expect high risks controlled as far up the hierarchy as reasonably practicable.
How detailed should job steps be?
Fine enough that hazards become visible, coarse enough to stay usable — typically 3 to 10 steps per job. "Operator lifts the drum and pours into the mixer" is one step; splitting it further hides the manual-handling and chemical hazards behind a wall of detail.
What do I do with a high-risk score?
Act before the work continues: apply higher-level controls, re-score the residual risk, and record who approved the task in the meantime. A high score left with "PPE and be careful" as the only control is the single most common OH&S audit finding.