This approach separates two fundamentally different questions: “How likely is the hazardous situation?” and “If it occurs, how likely is actual harm?” Keeping them separate produces more accurate risk estimates and makes the effect of specific risk controls more visible.
The Two-Factor Probability Model
Traditional risk matrices use a single probability axis. The P1xP2 model decomposes probability into two independent factors:
| Factor | Question | Scale | Measurement |
|---|
| P1 — Hazard Probability | How likely is the hazardous situation to occur? | 0-5 | Frequency ranges (1/100,000 to 1/1) |
| P2 — Harm Probability | Given the hazardous situation, how likely is actual harm? | 0-5 | Percentage ranges (<=5% to >=96%) |
P1 — Hazard Probability Scale
| Level | Label | Frequency Range | Example |
|---|
| 0 | Unanalyzed | — | Default for new records |
| 1 | Very unlikely | <= 1 in 100,000 | Rare manufacturing defect |
| 2 | Unlikely | <= 1 in 10,000 | Infrequent component failure |
| 3 | Possible | <= 1 in 1,000 | Occasional user error |
| 4 | Likely | <= 1 in 100 | Common operating condition |
| 5 | Very likely | <= 1 in 1 | Expected during normal use |
P2 — Harm Probability Scale
| Level | Label | Percentage Range | Example |
|---|
| 0 | Unanalyzed | — | Default for new records |
| 1 | Rare | <= 5% | Hazardous situation almost never causes injury |
| 2 | Occasional | 6 - 25% | Some chance of harm if situation occurs |
| 3 | Probable | 26 - 75% | Harm is likely given the hazardous situation |
| 4 | Frequent | 76 - 95% | Harm is very probable |
| 5 | Almost certain | >= 96% | Harm is virtually guaranteed |
Probability Bucketing
The raw P1 x P2 product ranges from 1 to 25. This product is bucketed into a 5-level composite probability scale:
| Composite Level | Label | P1 x P2 Range | Interpretation |
|---|
| 1 | Very Low | 1 - 3 | Negligible combined probability |
| 2 | Low | 4 - 8 | Low combined probability |
| 3 | Medium | 9 - 15 | Moderate combined probability |
| 4 | High | 16 - 20 | High combined probability |
| 5 | Very High | 21 - 25 | Very high combined probability |
The 5x5 Risk Matrix
The composite probability (bucketed P1xP2) forms the Y-axis. Harm severity forms the X-axis. Their intersection determines the risk classification.
Harm Severity Scale
| Level | Label | Definition | Default? |
|---|
| 1 | Negligible | Temporary discomfort, no medical intervention | |
| 2 | Minor | Temporary injury, no medical intervention required | |
| 3 | Serious | Injury requiring medical intervention | |
| 4 | Critical | Permanent impairment or life-threatening | Yes (conservative default) |
| 5 | Catastrophic | Patient death | |
Unassessed harms default to Critical (level 4), not Catastrophic. This is deliberate — it forces analysis while avoiding the alarm fatigue that a maximally pessimistic default would cause.
Risk Classification
The matrix intersection produces one of three risk levels:
| Classification | Color | Meaning | Action Required |
|---|
| Acceptable | Green | Risk is tolerable | No further action needed |
| Investigation | Amber | Risk is in the ALARP zone | Requires benefit-risk analysis or further reduction |
| Unacceptable | Red | Risk exceeds acceptable threshold | Mandatory risk reduction required |
Pre-Mitigation and Post-Mitigation
Every risk record carries two complete probability assessments:
| Phase | P1 Field | P2 Field | Composite | Risk Level |
|---|
| Pre-mitigation | preHazardProbability | preHarmProbability | preControlProbability | preRisk |
| Post-mitigation | postHazardProbability | postHarmProbability | postControlProbability | postRisk |
How Risk Controls Affect the Matrix
Risk controls change the post-mitigation P1, P2, or both:
- Inherent safety by design — Typically reduces P1 by eliminating the hazardous situation entirely
- Protective measures — May reduce P1 (prevents exposure) or P2 (prevents harm given exposure)
- Information for safety — Usually reduces P2 by enabling the user to avoid harm
The Risk Matrix Report generates two side-by-side 5x5 matrices from live data — one pre-mitigation, one post-mitigation — so the overall risk profile shift is immediately visible. See Read the Risk Matrix Report for details.
Related Pages
