A risk matrix plots the severity of a potential outcome against its likelihood in a grid of coloured cells — green/yellow/red — to produce a rapid, qualitative verdict of the risk. It is the most common tool in operational SMS and the most criticised in the risk-science literature.
Overview of the framework
The ICAO Safety Management Manual (Doc 9859) 5×5 risk matrix is the canonical aviation form, with severity levels Catastrophic, Hazardous, Major, Minor, and Negligible, and likelihood levels Frequent, Occasional, Remote, Improbable, and Extremely Improbable. Each cell is assigned a tolerability colour: unacceptable (red), tolerable subject to mitigation (yellow), or acceptable (green). The FAA's Safety Risk Management Policy (Order 8040.4B) and EASA's Part-ORO use close variants (ICAO, 2018; FAA, 2018).
In practice, the matrix is the operational output of the Safety Risk Management process defined in SMS: once a hazard is identified, its associated risk is scored before and after controls are applied. The matrix drives the Accept / Mitigate / Avoid decision and feeds the safety performance indicator set.
Figure 1 · Canonical ICAO 5×5 risk matrix. Severity on the horizontal axis, likelihood on the vertical. One example hazard is plotted at Occasional × Major.
EUROCONTROL ERCS and ARMS event risk classification share the same lineage.
Benefits
Fast and universal. Operators, engineers, and executives can all use it without training in probability theory.
Visual tolerability. Red/yellow/green cells communicate urgency at a glance.
Regulator-aligned. Baked into ICAO, FAA, EASA, and most national aviation SMS rulebooks.
Before/after framing. Naturally demonstrates risk reduction achieved by controls.
Integrates with the hazard register. One-cell-per-hazard output feeds dashboards and reports.
Low data requirements. Works with subjective estimates; no historical failure-rate data required.
Supports conversation. Cells and boundaries are a prompt for discussion about criteria and tolerability.
Compatible with bow-tie. Often used to score the residual risk after barrier analysis.
Limitations
Range compression. Five bands collapse orders of magnitude; a "major × remote" event and a "catastrophic × extremely improbable" event look similar and can be ranked the same.
Inconsistent orderings. Cox (2008) showed that matrices can assign higher qualitative ratings to quantitatively lower risks and vice versa.
Hidden value judgements. The shape of the green/yellow/red zones encodes risk appetite that is rarely made explicit.
Ambiguous definitions. Category labels are prone to interpretation — Thomas, Bratvold, & Bickel (2014) found significant scorer drift in practice.
No uncertainty handling. A single cell hides the breadth of uncertainty, strength of knowledge, and assumption dependence.
Encourages ritualism. Filling the matrix can substitute for analysis when teams treat it as compliance rather than assessment.
Poor for portfolio decisions. Comparing two hazards via matrix colour does not support rational investment allocation.
In short
The risk matrix is the lingua franca of operational SMS — quick, visual, and regulator-approved. Use it to communicate and triage, not to rank investments or to hide deep uncertainty. Where decisions matter, pair it with bow-tie, QRA, or an ACU-style strength-of-knowledge assessment.