Your HIRARC has a risk rating. It’s a number — 12 out of 25, perhaps, sitting in an amber band on your 5×5 matrix. It looks precise. It looks measured. It isn’t.
In most workplaces in Malaysia, the risk rating in a HIRARC document is not a measurement. It is a consensus. And the difference between those two things is significant.
How Most Risk Ratings Are Actually Produced
The typical process goes like this: a team gathers — usually the supervisor, the safety officer, and a few workers. They review each hazard. For each one, they score likelihood on a scale of 1 to 5, and consequence on a scale of 1 to 5. They multiply. They get a number.
The consequence score has some structure behind it — severity categories give a framework. But the likelihood score? In the vast majority of HIRARC exercises in Malaysia, the likelihood score is a group vote.
“How likely is this?” someone asks. A few people look at each other. Someone says “probably a 3.” Someone else nods. The score is recorded.
That number is not derived from historical incident frequency data. It is not based on exposure time per shift or task. It is not calculated from equipment failure rates or near-miss trends. It reflects how the team felt about the risk on the day the HIRARC was conducted.
Why This Is a Problem
The entire risk rating depends on the likelihood score. And the risk rating determines what happens next — whether a risk is classified as low, medium, high, or critical, and therefore how urgently controls must be implemented.
Consider the gap between a score of 2 and a score of 3 on your likelihood scale. A 2×4 result gives you a risk score of 8 — green. A 3×4 result gives you 12 — amber. The difference between “acceptable” and “action required” is one point on a scale that was defined by team consensus.
One person’s “unlikely” is another person’s “possible.” And this is not a problem of individual carelessness — it is a structural problem with how likelihood is defined in most HIRARC frameworks.
If your likelihood scale says “unlikely (2) = could occur but not expected,” that definition is broad enough to contain almost any opinion. Two experienced safety officers can review the same hazard, use the same scale, and produce scores that differ by two points — producing risk ratings that fall in different colour bands.
The Consequence: Controls Are Prioritised on Shaky Ground
When the risk rating is unreliable, the prioritisation of control measures becomes unreliable too.
If a hazard is rated “low” because the team happened to agree on a likelihood of 1 — but in reality, based on historical data from similar operations, it should have been rated 3 — then the hazard receives less attention than it deserves. It may be reviewed annually instead of quarterly. The engineering control budget may go to a hazard with a higher-sounding score that is, in reality, no more dangerous.
This is not a hypothetical. It is a pattern that incident investigators find repeatedly: hazards that were rated low in HIRARC documents, received minimal control attention, and contributed to events that, on review, were entirely foreseeable.
What the Risk Matrix Is Actually Good For
None of this means the risk matrix should be abandoned. It remains the most practical structured tool available for workplace risk assessment in Malaysia, particularly for teams that do not have access to quantitative risk assessment data.
But it should be understood for what it is: a structured conversation tool, not a measurement instrument.
The matrix imposes a process on the discussion of risk. It ensures that likelihood and consequence are considered separately. It produces a result that can be recorded, reviewed, and compared across hazards. These are real benefits.
The problem is when the output of the matrix — the colour-banded score — is treated as if it were an objective measurement. It is not. It is a structured opinion. And structured opinions need to be calibrated.
How to Improve Likelihood Scoring in Your HIRARC
The most effective change you can make to your HIRARC process is to define your likelihood categories with specificity.
Rather than “unlikely = could occur but not expected,” define it as: “occurs less than once in five years of operation at this site, based on historical records.” Rather than “possible = could occur at some time,” define it as: “has occurred at this site or a comparable site within the past five years.”
When likelihood categories are anchored to observable data — incident history, near-miss records, equipment inspection results — the likelihood score becomes less about consensus and more about evidence.
This approach requires that you maintain records worth referencing: near-miss reports, inspection findings, maintenance logs. If those records do not exist, you cannot calibrate your likelihood scoring — and you should acknowledge that limitation honestly in your HIRARC.
The Question to Ask at Your Next HIRARC Review
Before you accept any likelihood score in your HIRARC, ask one question: what is this score based on?
If the answer is “the team agreed” or “that’s what we scored last time” — you do not have a risk rating. You have a documented opinion. That may be acceptable as a starting point, but it should be clearly understood as such, and reviewed against any available data.
A risk matrix is not a lie. But it is only as reliable as the inputs that go into it. In most workplaces, those inputs are less reliable than the colour band suggests.
Ready to run a HIRARC that reflects real risk — not just consensus? Cikgu Barrier’s Risk Assessment That Works program teaches teams how to identify hazards accurately, score risk consistently, and select controls that actually work. Available as a public workshop or in-house delivery across Malaysia.