MANUAL

RISK ASSESSMENT MATRIX

PTS 60.133
MARCH 1996

PREFACE

PETRONAS Technical Standards (PTS) publications reflect the views, at the time of publication,
of PETRONAS OPUs/Divisions.
They are based on the experience acquired during the involvement with the design, construction,
operation and maintenance of processing units and facilities. Where appropriate they are based
on, or reference is made to, national and international standards and codes of practice.
The objective is to set the recommended standard for good technical practice to be applied by
PETRONAS' OPUs in oil and gas production facilities, refineries, gas processing plants, chemical
plants, marketing facilities or any other such facility, and thereby to achieve maximum technical
and economic benefit from standardisation.
The information set forth in these publications is provided to users for their consideration and
decision to implement. This is of particular importance where PTS may not cover every
requirement or diversity of condition at each locality. The system of PTS is expected to be
sufficiently flexible to allow individual operating units to adapt the information set forth in PTS to
their own environment and requirements.
When Contractors or Manufacturers/Suppliers use PTS they shall be solely responsible for the
quality of work and the attainment of the required design and engineering standards. In
particular, for those requirements not specifically covered, the Principal will expect them to follow
those design and engineering practices which will achieve the same level of integrity as reflected
in the PTS. If in doubt, the Contractor or Manufacturer/Supplier shall, without detracting from his
own responsibility, consult the Principal or its technical advisor.
The right to use PTS rests with three categories of users :
1)
2)
3)

PETRONAS and its affiliates.

Other parties who are authorised to use PTS subject to appropriate contractual
arrangements.
Contractors/subcontractors and Manufacturers/Suppliers under a contract with
users referred to under 1) and 2) which requires that tenders for projects,
materials supplied or - generally - work performed on behalf of the said users
comply with the relevant standards.

Subject to any particular terms and conditions as may be set forth in specific agreements with
users, PETRONAS disclaims any liability of whatsoever nature for any damage (including injury
or death) suffered by any company or person whomsoever as a result of or in connection with the
use, application or implementation of any PTS, combination of PTS or any part thereof. The
benefit of this disclaimer shall inure in all respects to PETRONAS and/or any company affiliated
to PETRONAS that may issue PTS or require the use of PTS.
Without prejudice to any specific terms in respect of confidentiality under relevant contractual
arrangements, PTS shall not, without the prior written consent of PETRONAS, be disclosed by
users to any company or person whomsoever and the PTS shall be used exclusively for the
purpose they have been provided to the user. They shall be returned after use, including any
copies which shall only be made by users with the express prior written consent of PETRONAS.
The copyright of PTS vests in PETRONAS. Users shall arrange for PTS to be held in safe
custody and PETRONAS may at any time require information satisfactory to PETRONAS in order
to ascertain how users implement this requirement.

AMENDMENT RECORD SHEET

Chapter Section
No.
No.

Description

All

All

Original paper issue

All

All

Conversion for CD-ROM

All

All

New issue

Correction/
Update

Date

Initials

Reference
Indicator

Oct 91
Conversion

Feb 95

NPC

SMAD/23

Update

Mar 96

GvdG

EPS/HE

TABLE OF CONTENTS
1.

INTRODUCTION

2.

THE RISK ASSESSMENT MATRIX

3.

THE APPLICATION IN HSE RISK MANAGEMENT

4.

THE APPLICATION IN INCIDENT INVESTIGATION

APPENDIX 1

CONSEQUENCE CATEGORY DEFINITION

APPENDIX 2

RISK ASSESSMENT MATRIX APPLICATION EXAMPLES

1.

INTRODUCTION
Management of HSE involves an assessment of the risks posed by incidents* that can develop
from the release of a hazard. A qualitative assessment of the risk, rather than a quantitative one,
is in many cases adequate to identify an appropriate course of action for managing the risk. The
potential risk of an incident can be classified by the use of the Risk Assessment Matrix which is
intended to replace the Risk Matrix and the Incident Potential Matrix.
Historically the Risk Matrix and the Incident Potential Matrix were developed separately. The
Incident Potential Matrix was developed first on the basis of earlier Operating Unit initiatives and
published in 1991 as a Shell Safety and Health Committee guide. It introduced the concept of
"potential consequences", i.e. "what could have gone wrong" in slightly different circumstances,
and was used together with a measure of exposure to assess the relative importance of
incidents. The vertical "potential consequence" axis of the Incident Potential Matrix has been
widely adopted, whereas the horizontal axis has been variously interpreted by the Operating
Units with some using a measure of probability or likelihood of occurrence, while others have
used some measure of exposure. In some Operating Units, it is considered that only the potential
consequence should determine the depth of investigation, without taking the likelihood of
occurrence or exposure into consideration.
The Risk Matrix was developed later in conjunction with the development of the Hazards and
Effects Management Process (HEMP) of the HSE Management System, as a tool to visibly
express company policy and to demonstrate compliance with the risk tolerability criteria and the
ALARP principle. The vertical axis of the Risk Matrix was identical to that of the Incident Potential
Matrix. For the horizontal axis, a qualitative description of probability was used.
In order to promote a consistent approach, it is now recommended to use this horizontal
probability axis for all assessment of risks from incidents as it makes risk classification easier and
takes into account all the elements used in various Operating Units (frequency of activity, number
of people exposed to a hazard, likelihood of release of the hazard and functioning of barriers,
and other circumstances that may impact on the development of an incident).This guideline
describes the Risk Assessment Matrix (defining the horizontal and vertical axes), and gives
examples of its use.

2.

THE RISK ASSESSMENT MATRIX

Description
The Risk Assessment Matrix (Figure 1) is a tool that standardises qualitative risk assessment
and facilitates the categorisation of all threats to health, safety, environment and reputation. The
matrix axes, consistent with the definition of risk, are Consequences and Probability (or
Likelihood).

Figure 1 :

Risk Assessment Matrix

C o nse q u e n c e

Inc re a sing Probability

Rating

People

Assets

Environment Reputation

No
injury

No damage No effect

No impact

Slight injury

Slight
damage

Slight effect

Slight impact

Minor injury

Minor
damage

Minor effect

Limited impact

Major injury

Localised
damage

Localised
effect

Considerable
impact

Single
fatality

Major
damage

Major effect

Major national

Mutiple
fatalities

Extensive
damage

Massive effect

Major
international

Never heard
Heard of
of in --incident in -industry
industry

Incident has
Happens
Happens
occurred in several times several times
our company per year in co. per year in
locn.

A scale of consequences from "0" to "5" is used to indicate increasing severity. The
consequences are those of credible scenarios (taking the prevailing circumstances into
consideration) that can develop from the release of a hazard. The potential consequences, rather
than the actual ones, are used. These are defined as the consequences that could have resulted
from the released hazard if circumstances had been less favourable.
The probability on the horizontal axis is estimated on the basis of historical evidence or
experience that the identified consequences have materialised within the industry, the company
or a smaller unit. Note that this should not be confused with the probability that the hazard is
released: it is the probability of the estimated potential consequences occurring.
Classification of Potential Consequences
The consequences of the release of a hazard or effect are identified in each of the four
categories (harm to people, asset damage, environmental effect and potential impact on the
reputation of the company) by selecting an appropriate row description on the vertical axis of the
matrix. The definition of the categories is given in Appendix 1.
Risk is described, not only in terms of risk to health, safety and the environment, but also in
terms of risk to reputation. Reputation is driven by perceptions and by societal issues. Risk in
scientific terms may be reduced to the level reasonably practicable (ALARP), yet the overall risk
to reputation may still remain high. Risk to reputation cannot be ignored and advice may be
sought from Public Affairs experts.
Consequences should be estimated on the basis of what might have resulted under slightly
different circumstances. Examples are:
Scenario

Actual outcome

Potential consequence

A crane drops a load one meter

besides a person.

Damage to load.

Fatal injury if a person had

been standing under the
load.

Car rolls over on a desert road.

Damage to car, no injury (seat Serious injury.

belt was worn).

Operator opens wrong valve:

diesel fuel polluting river; quickly
spotted by someone else.

Minor pollution

Exposure to H2S: quickly

rescued and resuscitated

2
days
observation
hospital: minor injury.

Exposure to benzene exceeding

current occupational exposure
limits

None.

Cancer (leukemia).

Flare carries over some crude.

Sooting flare.

Oil in flare pit. Pit on fire.

Heavy smoke. Soot on
nearby houses and cars.
Complaints. Media publicity.
Damage claims.

Major effect if the spill had

not been noticed so quickly.
in Fatal
or
permanent
total/partial disability.

Assessment of Probability
The horizontal axis represents the probability or the measure of likelihood of the occurrence of an
undesired event following the release of a hazard. The scale of the horizontal axis is indicatively
defined :
"A - never heard of in the __ industry",
"B - heard of in the __ industry",
"C - has occurred in our company",
"D - happens several times per year in company", and
"E - happens several times per year in location".
This assessment is based on experience and is indicative of the likelihood of undesired
consequences materialising. Note again that this should not be confused with the probability that
the hazard is released: it is the probability of the estimated potential consequences occuring.

In smaller Operating Units or new ventures where experience is limited, it is recommended that
the probability is assessed on the basis of knowledge from similar operations in other Operating
Units. In new ventures, the potential consequence scale only can be used and investigations
carried out for all incidents with potential higher than 3. By doing so, every opportunity is used for
learning from the potentially serious incidents, no matter how unlikely their occurence may be.
Risk Classification
Using the Risk Assessment Matrix, risk is classified by three characters made up as follows:

the first character is a measure of the likelihood of an undesired event: A-E

the second character is the consequence severity that could occur with
that event: 1-5, and
the third character shows to which consequence category the assessment
pertains - People (P), Asset (A), Environmental (E) nature or Reputation (R).

The intersection of the chosen column with the chosen row is the risk classification. For the same
scenario, different classifications may apply to P, A, E, and R. Some examples of incident
classification are given in Appendix 2.
3.

THE APPLICATION IN HSE RISK MANAGEMENT

A suitable overlay for using the Risk Assessment Matrix as an element of the HSE management
system to identify actions to reduce risk to ALARP is shown in Figure 2 below.
Figure 2

Risk Management Overlay

(for expressing Company policy and strategic objectives)

Increasing Probability

Rating

Never heard
of in --industry

Heard of incident
in -- industry

Incident has
occurred in our
company

Happens
several times per
year in co.

Happens several
times per year in
locn.

0
1
2
3
4

Manage for continuous

improvement
Incorporate Risk
Reduction Measures
Intolerable

Objective setting is at the heart of the HSE Management System and the Risk Assessment
Matrix overlay format shown above is a useful tool that can help management in the
interpretation of risk (expressed in the policy and strategic objectives of the company) and also
help the line in understanding how this policy and these objectives are to be regarded (in terms
of tolerable risk) in their day to day operations.
The definition of tolerable risk should be derived from the policy and strategic objectives of the
company and can be indicated on the Risk Assessment Matrix by company management by
shading-in the appropriate areas. The shading indicated in the matrix is recommended practice;
deviations can be considered for small operating entities. The focus provided by using the Risk
Assessment Matrix in this way enables company management to determine whether the risk
levels inherent in the company's operations are tolerable and whether they fit with current
corporate policies and objectives. For example, if an operation would result in scenarios which lie

in an area on the Risk Assessment Matrix that the company would normally regard as
"intolerable" in policy terms, then alternative ways of carrying out the operation should be
investigated. If there are no alternative ways, then management must decide whether the
operation should proceed or not. If it has to proceed then special treatment in regard to the level
of control must be implemented before the operation takes place.
The Risk Assessment Matrix overlay may also be used on a scenario by scenario basis to
prioritise risk reduction efforts. It is adaptable to varying levels of information and depths of
evaluation. It has a built-in presentation format that lends itself to review. Because it is qualitative
and the scales relative, instead of absolute, exact knowledge is not required and thus risk
understanding can be reached fairly easily. Examples of risk determination using the Risk
Assessment Matrix are included in Appendix 2.
A company should consider using the Risk Assessment Matrix as a part of its implementation of
the HSE Management System and of HSE Cases (HSE Reports). The use of the Risk
Assessment Matrix will:

enhance the appreciation of HSE risk tolerability and ALARP at all levels in the company,
assist in making the PETRONAS Group policy and standards and local company HSE
policies relevant to day to day operations via the setting of clear risk based objectives
that can be cascaded into the setting of individual tasks and targets, and
provide the basis for the implementation of the risk-based HSE Management System in
accordance with PETRONAS Group Guidelines.

4.

THE APPLICATION IN INCIDENT INVESTIGATION

For use in incident follow-up, the matrix can be used with an overlay as shown in Figure 3 to
decide on depth of investigation, investigation team composition, reporting level, etc
Figure 3

Incident Follow-up Overlay

Increasing Probability

Rating

Never heard
of in --industry

Heard of incident
in -- industry

Incident has
occurred in our
company

Happens
several times per
year in co.

Happens several
times per year in
locn.

0
1
2

to be investigated
and discussed

3
4
5

in depth analysis
and discussion at
management
in depth analysis,
level
management involvement, voluntary
reporting to service companies

Suggestions for team composition, reporting and feedback to management are shown below.
Company managements are encouraged to review and customise the table.
Risk Rating

Investigation team composition

Reporting/discussion

Low risk (unshaded area)

local supervisor + HSE focal

point

reporting to department
head

Medium Risk
(lightly shaded area)

asset holder + other line staff

as required + HSE advisor

reporting to OU
management

High Risk
(heavily shaded area)

Member of Management Team

+ asset holder + HSE advisor +
independent person e.g. from
corporate
organisation
+
specialists as required

reporting to CEO and

voluntary reporting to
Service Companies

The Incident Follow-up Overlay is intended for use by location personnel after an incident
occurrence to:

assess the significance of an incident in terms of its ultimate potential for injury, damage,
environmental and reputation effects,

provide guidance in determining the depth or extent of an incident investigation and its
follow-up, and

increase the awareness of Health, Safety and Environmental implications of any incident.
Application of the tool is expected to:

promote near-miss reporting, improve knowledge of potentially serious incidents,

enhance the direction of safety efforts and make more efficient use of investigation time,
improve management of risk reduction efforts, and focus on where the greatest benefits
can be achieved,
provide a broad incident occurrence indicator, and
assist in media handling by the Public Affairs staff due to an improved insight into the
potential severity of an incident.

APPENDIX 1 CONSEQUENCE CATEGORY DEFINITION

Harm to People
No.

Description

No injury or damage to health.

Slight injury or health effects (including first aid case and medical treatment case) Not affecting work performance or causing disability.

Minor injury or health effects (Lost Time Injury) - Affecting work performance, such
as restriction to activities (Restricted Work Case) or a need to take a few days to fully
recover (Lost Workday Case). Limited health effects which are reversible, e.g. skin
irritation, food poisoning.

Major injury or health effects (including Permanent Partial Disability) - Affecting work
performance in the longer term, such as a prolonged absence from work. Irreversible
health damage without loss of life, e.g. noise induced hearing loss, chronic back
injuries.

Single fatality - From an accident or occupational illness (poisoning , cancer).

Multiple fatalities - From an accident or occupational illness (poisoning, cancer).

Asset Damage
No.

Description (100% costs, USD)

Zero damage

Slight damage - No disruption to operation (costs less than 10,000)

Minor damage - Brief disruption (costs less than 100,000)

Local damage - Partial shutdown (can be restarted but costs up to 500,000)

Major damage - Partial operation loss (2 weeks shutdown costs up to 10,000,000)

Extensive damage - Substantial or total loss of operation (costs in excess of

10,000,000)

Environmental Effect
No.

Description

Zero effect - No environmental damage. No change in the environment. No financial

consequences.

Slight effect - Local environmental damage. Within the fence and within systems.
Negligible financial consequences.

Minor effect - Contamination. Damage sufficiently large to attack the environment.

Single exceedance of statutory or prescribed criterion. Single complaint. No permanent
effect on the environment.

Localised effect - Limited loss of discharges of known toxicity. Repeated exceedance

of statutory or prescribed limit. Affecting neighbourhood.

Major effect - Severe environmental damage. The company is required to take

extensive measures to restore the contaminated environment to its original state.
Extended exceedance of statutory or prescribed limits.

Massive effect - Persistent severe environmental damage or severe nuisance

extending over a large area. In terms of commercial or recreational use or nature
conservancy, a major economic loss for the company. Constant, high exceedance of
statutory or prescribed limits.

Impact On Reputation
No.

Description

No impact - No public awareness

Slight impact - Public awareness may exist, but there is no public concern.

Limited impact - Some local public concern. Some local media and/or local political
attention with potentially adverse aspects for company operations.

Considerable impact - Regional public concern. Extensive adverse attention in local

media. Slight national media and / or local / regional political attention. Adverse stance
of local government and/or action groups.

National impact - National public concern. Extensive adverse attention in the national
media. Regional / national policies with potentially restrictive measures and/or impact
on grant of licences. Mobilisation of action groups.

International impact - International public attention. Extensive adverse attention in

international media. National / international policies with potentially severe impact on
access to new areas, grants of licences and/or tax legislation.

APPENDIX 2 RISK ASSESSMENT MATRIX APPLICATION EXAMPLES

Examples In HSE Risk Management
1.

Risk Scenario: All the tanks in a terminal are within bunds. One of the tanks is receiving gasoline
from a tanker. The operation is started at night. The storage tank is overfilled and a large vapour
cloud is formed by vaporising gasoline. The vapour cloud is ignited by a passing vehicle. A major
explosion and fire develop which destroy 10 of the 15 tanks at the terminal, cause extensive
damage, and result in multiple fatalities. Such an accident has not occurred previously in the
Operating Unit.
C o n se q u e n c e

Rating

People

Assets

Inc re a sing Pro b a b ility

Environment Reputation

Never heard
of in --industry

Heard of
incident in
-- industry

No
injury

No damage No effect

No impact

Slight injury

Slight
damage

Slight effect

Slight impact

Minor injury

Minor
damage

Minor effect

Limited impact

Major injury

Localised
damage

Localised effect

Considerable
impact

Single
fatality

Major
damage

Major effect

Major national

Mutiple
fatalities

Extensive
damage

Massive effect

Major
international

Incident has
Happens Happens several
occurred in several times times per year in
our company per year in
locn.
co.

Demonstrate ALARP

INTOLERABLE

Using the Risk Assessment Matrix (see the figure above), this scenario for people, assets and
company reputation plots in the region categorised as Demonstrate ALARP by company
management. This means that for this type of loss of containment event a cost benefit analysis
should be undertaken to determine if there are additional cost effective measures that could be put
in place to further reduce the risks to people, assets and company reputation. The risk to the
environment should be managed for continuous improvement.
2.

A proposal for a new installation has two product movement scenarios: transport by truck or the
installation of a pipeline.
For the trucking scenario (indicated by a O on the matrix shown below), the following risk
classifications were identified: C5(P), C2(A), D1(E), C1(R). The risk to people is categorised as
"intolerable". For this scenario to be undertaken special treatment in regard to protecting people
must be implemented. Cost effective measures to reduce the risk to people should be undertaken.
For the pipeline scenario (indicated by a on the matrix), the following risk classifications were
identified: B2(P), B3(A), B3(E), B1(R). The risks to people, assets, environment and reputation are
categorised as tolerable, and if the pipeline scenario is implemented, should be managed for
continuous improvement in HSE performance.
Consequence

Rating

People

No

injury

Assets

Environment

Increasing Probability

Reputation

No damage

No effect

No impact

Slight injury

Slight damage

Slight effect

Slight impact

Minor injury

Minor damage

Minor effect

Limited impact

Major injury

Localised
damage

Localised effect

Considerable
impact

Single fatality

Major damage

Major effect

Major national

Extensive
Mutiple fatalities
damage

Massive effect

Major international

Never heard
of in --industry

Heard of
incident in
-- industry

R
P

Happens
Happens
Incident has
occurred in our several times several times
company
per year in co. per year in locn.

Demonstrate ALARP

AE

INTOLERABLE

Examples of Incident Classification

1.

During a weekly off loading operation from a supply vessel, a roof section of a container became
detached and fell into the sea striking the vessel on the port side. Containers containing chemicals
are delivered once a month.
The potential consequence to people from this incident is a single fatality. This corresponds to a
severity rating code of 4. A similar incident with fatal consequences occurred 3 years ago. Several
times per year local damage occurs as a result of loose items falling during off loading. The
Incident Potentials determined are:
C4(P) - fatality if a person was below falling roof.
D3(A) - equipment damage causes partial shutdown.
C1(E) - slight environmental effect.

2.

Bus carrying contract cleaning staff fails to stop at security check and hits the security gate. There
were no injuries. There have been previous occasions in company when sudden stops from hitting
obstacles resulted in fractures or bruises.
The following classifications are appropriate:
D3(P) - injuries from sudden stop.
D2(A) - damage to vehicle or obstacles

3.

Mechanical digger severed a live 415 Volt underground cable to a laboratory while excavating to
lay water pipes. There were no injuries.
B4(P) - possible electrocution of driver (one person).
C2(A) - loss of ongoing experiment and equipment.

4.

Radioactive contamination found on work bench during routine monitoring.

This incident would be classified: B4(P) - internal contamination can lead to cancer; cases are known in industry
E3(E) - repeated breach of statutory rules.

5.

While trying to jump start a car (12V) with a crane battery (24V) the car battery exploded, spraying
acid on operator. Actual consequences : damage to clothing and car.
C3(P) - possible severe eye injury.
C2(A) - damage to car.

6.

Filing cabinet drawers are opened adjacent to a busy access route in an office. The cabinet
overbalances and falls over, nobody is hurt but people could have been passing. It has occurred
once before in the Operating Unit that someone was seriously hurt by such an accident.
D3(P) - major injury to person passing.

7.

During "start-up" an exchanger joint fails releasing an estimated 5-tonne cloud of propane. The
operator jumped away and sprained his ankle.
B5(P) - possible multiple fatalities if the gas cloud had been ignited.
B3(A) - damage in case of gas cloud explosion.

8.

During the loading of diesel from a tank, the ship's hose sprung a leak and the river was
contaminated. The contamination was noted within minutes by an outsider who warned the loading
master. The damage could have been much worse if it had not been spotted so quickly. Small
leaks have occurred earlier in the company, but not a major one.
B3 (E) or D2 (E) - spills with minor effects have occurred, more serious local effect has not
occurred previously in this company
D2 (R) - local population gets worried about frequent minor spills