Method guide

Occupational risk assessment: choosing a method and calculating risk correctly

An occupational risk assessment is a structured identification of hazards at a workstation, an estimate of the likelihood and severity of harm, and a decision on whether the risk is acceptable and which controls are needed. Polish law requires risk to be assessed and documented but does not prescribe a single method — the most common are PN-N-18002, the 5×5 matrix and the Fine-Kinney Risk Score.

The method is not the goal. A good assessment can be repeated, separates risks well enough to set priorities and ends with concrete actions, not just a number in a table.

Risk assessment
Risk matrix
Risk Score
Fine-Kinney

Published: 2026-10-04 · Updated: 2026-10-04 · 12 min · Varilo deployment team

Safety specialist and press operator reviewing an occupational risk assessment with a risk matrix on a tablet

Employer duties in brief

The Polish Labour Code (Art. 226) requires employers to assess and document occupational risk, apply the necessary preventive measures and inform employees about the risk. Details, including taking all workplace factors and the way work is performed into account, are set out in the regulation on general health and safety rules.

The law does not prescribe an estimation method. The employer chooses it, but it should be described in the documentation and applied consistently. This article is guidance, not legal advice; confirm obligations for a specific site with your safety professional.

Comparison of occupational risk assessment methods: PN-N-18002 table, 5×5 matrix and Fine-Kinney Risk Score — The three most common risk assessment methods and their calculation rules (labels in Polish).

Five steps of a risk assessment

1. Gather information about the workstation: tasks, machines, substances, working time and the people doing the work (including those with special status). 2. Identify hazards — on site, with the worker, not from a desk. 3. Estimate risk with the chosen method for each hazard, taking existing controls into account. 4. Decide on acceptability and plan actions following the hierarchy: elimination, substitution, engineering, administrative controls, PPE. 5. Document, inform employees and set a review date.

The most common failure is skipping step 4 in practice: the risk is calculated, but the controls “to be implemented” have no owner or deadline. The assessment is then formally correct and operationally useless.

The PN-N-18002 method: three levels, quick result

The method based on the Polish standard PN-N-18002 rates severity (low, medium, high) and likelihood (unlikely, likely, highly likely). The result is read from a table: low, medium or high risk. High risk is unacceptable, medium is acceptable with a reduction plan, low is acceptable.

Its strengths are simplicity and familiarity among inspectors and safety staff. Its weakness is poor differentiation: many hazards land in “medium”, making it hard to decide what to do first. The standard also describes a five-level variant that partly solves this.

The 5×5 matrix: R = L × S

Likelihood (L) and severity (S) are rated 1–5 and risk is the product R = L × S, ranging from 1 to 25. Typical bands: 1–4 low, 5–9 medium, 10–15 high, 16–25 very high. The organisation sets the bands and scale descriptions — what matters is that they are written down and understood the same way by every assessor.

Example: a fall when climbing onto a press platform without a handrail. Severity: serious injury with lost time, S = 4. Likelihood: several times per shift on oily steps, L = 3. R = 12 — high, action required within a set deadline. After fitting a handrail and anti-slip matting, L drops to 1 and R = 4 — low.

The matrix suits risk registers in management systems (ISO 45001, ISO 9001, ISO 22000) because the same language works for safety, quality and food safety.

5×5 risk matrix with values 1–25 colour-coded as low, medium, high and very high risk — Example 5×5 matrix: risk is likelihood multiplied by severity. Bands are set by the organisation (labels in Polish).

Risk Score (Fine-Kinney): R = S × E × P

Risk Score adds a third factor — exposure (E), meaning how often the worker meets the hazard. Severity (S) runs from 1 (minor injury) to 100 (catastrophe, multiple fatalities), exposure from 0.5 (very rare) to 10 (continuous) and probability from 0.1 (practically impossible) to 10 (expected).

Typical interpretation: below 20 — negligible or low; 20–70 — possible, needs attention; 70–200 — substantial, correction needed; 200–400 — high, immediate improvement; above 400 — very high, consider stopping work. Example: cleaning a shaft without isolating energy, S = 15, E = 6 (daily), P = 3 (quite possible), R = 270 — high; a LOTO procedure lowers P to 0.5 and R to 45.

Risk Score separates risks very well and shows the effect of task frequency, but needs trained assessors — the wide scale invites differences between people.

How V-IMS supports occupational risk assessment

The V-IMS risk assessment module keeps workstation records in your chosen method, with change history and review dates. An AI assistant suggests typical hazards and controls for the described workstation — a person always reviews and approves the suggestions.

The assessment is connected to the rest of the system: substances from the chemical register, incidents and reports, CAPA actions and technical changes can signal that a record needs review. Controls become tasks with an owner and a deadline, and employees confirm they have read the record. Before field work, the team runs a short LMRA on a phone to check that conditions match the assessment.

Comparison of risk assessment methods

No method is “best” — what matters is fit for the site and consistent use.

Criterion	PN-N-18002 (3 levels)	5×5 matrix	Risk Score (Fine-Kinney)
Formula / approach	Read from a 3×3 table	R = L × S	R = S × E × P
Result range	Low / medium / high	1–25	From fractions to several thousand
Risk differentiation	Weak	Good	Very good
Accounts for frequency	Indirectly via likelihood	Indirectly via likelihood	Yes, separate factor E
Ease of learning	Very easy	Easy	Requires training
Good fit	Small firms, simple workstations	Integrated QHSE systems, risk registers	Manufacturing, maintenance, high-risk work

Key takeaways

The law requires assessment and documentation, not a specific method.
Write the method and acceptability bands into a procedure and apply them consistently.
Identify hazards at the workstation, together with the worker.
Estimate risk with the controls that actually work.
Every control to be implemented needs an owner and a deadline.
After implementing controls, calculate the residual risk.
Review after changes and incidents, not only once a year.

Related modules

VIMS module

Risk assessment — a living document instead of a binder

Run risk assessment online: hazards, risk levels, control measures and reviews in one place, connected to what actually happens on site.

LMRA

LMRA — the last check before anyone picks up a tool

A job risk assessment describes a workplace under typical conditions. LMRA answers a different question: is this work safe here, right now, with this crew?

Frequently asked questions

Which risk assessment method should I choose?

PN-N-18002 is enough for simple workstations. The 5×5 matrix works well in integrated management systems. Risk Score is worth using where exposure frequency matters and priorities must be set precisely, e.g. in manufacturing and maintenance.

Can one site use different methods?

Yes, deliberately — e.g. PN-N-18002 for offices and Risk Score for the shop floor. The rules must be documented, and results from different methods should not be compared directly.

Who should carry out the risk assessment?

The employer is responsible. In practice a team does it: the safety professional, the supervisor, a worker from the workstation and, where needed, maintenance or a chemicals specialist.

Can AI do the risk assessment for me?

AI speeds the work by suggesting hazards and controls, but it does not know your workstation. A person who has seen the workplace always reviews and approves the final assessment.

See risk assessment in V-IMS

We will show how to keep workstation records in your chosen method, use AI suggestions and connect the assessment with incidents, chemicals and CAPA actions.

Book a demo Knowledge base