The 5×5 Risk Matrix on UAE Sites: Why the Scores Drift and How to Calibrate Them

Pull four MSRAs from one UAE project and find the same hazard — work at height from an open slab edge — scored four different ways: 4×5, 3×4, 2×4, 3×3. Nobody was dishonest. Different people applied bands they had never seen defined.

A matrix that produces inconsistent numbers is worse than no matrix, because it looks like analysis. Scores drive what gets additional controls, what enters the monthly pack, what receives senior attention, and what a contractor is allowed to start. If the numbers are opinions in a grid, the control decisions that follow are opinions too.

This is how to make likelihood-by-severity scoring produce something a UAE project can defend.

What the matrix is actually for

A risk matrix is a ranking device, not arithmetic. It exists so that:

• entries can be ordered, so the worst exposures get attention first
• the effect of a control is visible — initial rating compared with residual rating
• a stop rule can be written: above a certain residual rating, work does not proceed on a supervisor's judgement alone

It fails the moment people treat the multiplication as a measurement. 4×5 is not twenty times anything; it is "high severity, high likelihood", and everyone reading it should picture the same situation.

Define the bands, or the scores are noise

Write the definition next to the number and keep it visible on the form. Severity is about the credible outcome; likelihood is about exposure and how well the control would hold.

Severity (consequence if the event occurs)

Likelihood (before controls, and then again after)

Two rules keep the bands honest:

• Score the credible worst outcome, not the average recent outcome. A fall from a leading edge is a severity 4 or 5 because of the energy involved, not because the last near miss was minor.
• Score initial rating with controls removed, then residual with controls in place. If the initial score does not fall after controls, either the controls are not real or nobody believed the first score.

Where drift comes from

• Optimism bias. The team has done this a hundred times; the score quietly drops to reflect comfort, not exposure.
• Desired outcome. A subcontractor scoring its own work tends not to reach a rating that stops the job or triggers a formal escalation.
• Averaging. Two people disagree, so the entry lands on a middle number that reflects neither view and gets forgotten.
• Low likelihood used as permission. "It's never happened" becomes a reason to keep working rather than a reason to check whether the control would hold if it did.
• Calibration by hierarchy. When the project manager scores lower than the safety officer every time, the process stops being technical.

A worked example

Activity: edge protection on a sixth-floor slab edge, following trades working close to the edge.

Note what the arithmetic shows: the residual stays high because severity cannot be engineered away. That is not a failure of the assessment — it is the honest answer, and it is exactly the kind of entry that should carry a named senior owner and a verification routine rather than a signature.

Write a stop rule and use it

Decide in advance what the project does with a high residual rating:

• Above the agreed threshold, work does not start until a named senior manager has reviewed the entry and either added a control or recorded why the residual is acceptable with the controls in place.
• Where the residual cannot be reduced further, record the reasoning explicitly — what else was considered, why it was not reasonably practicable, and who monitors it.
• Never let a high residual be closed by lowering the score without changing anything on site. That single habit destroys the credibility of every number in the system.

Calibrate once, with real entries

A single 20-minute session fixes most drift. Put ten real entries from the project on screen — good ones and bad ones — and ask the team to score each independently, then compare. Where the scores differ by more than one band, discuss until the reasoning, not the number, is agreed. Record the band definitions agreed in that session at the top of the form.

Then repeat it quarterly, or whenever a new subcontractor mobilises. The cost is one meeting; the return is a project where two people looking at the same hazard reach roughly the same answer.

What to record so the scoring is auditable

Every entry should carry, as a minimum: the activity and location, the hazard, the people exposed, the initial rating with a one-line reason, the controls in hierarchy order, the residual rating with a one-line reason, the named owner, the verification method and frequency, and the date of the last review.

That is enough for a reviewer — client HSE, consultant or authority — to follow the reasoning without a conversation. And it is the difference between a risk assessment that is referenced when work changes and one that is printed once and filed.

"Reference material, not legal advice. Requirements differ by emirate, authority and client."

Continue with

• Risk Register Best Practice: Keeping a Site Register That Actually Controls Risk — https://sitesafetyuae.com/resources/site-risk-register-best-practices
• ISO 45001 Self-Audit Essentials for UAE Construction Organisations — https://sitesafetyuae.com/resources/iso-45001-self-audit-essentials-uae-construction
• Documents & MSRA/RAMS module — https://sitesafetyuae.com/modules/documents — consistent scoring built into the template, not into the individual
• HSE KPIs & Reporting module — https://sitesafetyuae.com/modules/reporting — turning residual ratings and open controls into leading indicators

Site Safety UAE builds the HSE Operations Dashboard for UAE and GCC construction projects — risk assessments, registers, permits and the evidence behind them in one place. Start free, no card required — https://sitesafetyuae.com/get-started.