# Risk matrix

> A risk matrix scores a hazard by crossing how bad the outcome could be with how likely it is. The score sets which problems to fix first.

Source: https://incidentkit.ai/glossary/risk-matrix · Updated Oct 5, 2026

Also known as: risk assessment matrix, severity and probability matrix, Safety Assessment Code matrix

## How it works

The VA National Center for Patient Safety built a Safety Assessment Code (SAC) matrix to rank adverse events and close calls. Staff pick a severity and a probability and read the score from the grid.

| Severity | Probability |
| --- | --- |
| Minor | Remote: sometime in 5 to 30 years |
| Moderate | Uncommon: sometime in 2 to 5 years |
| Major | Occasional: several times in 2 years |
| Catastrophic | Frequent: several times in 1 year |

For RCA, SAC scores run from 1 to 3. The VA requires an RCA for a sentinel event or a high-probability near miss scored Actual 3 or Potential 3.

The related HFMEA hazard matrix scores from 1 to 16. A hazard score of 8 or higher goes on to a decision tree.

## Limits

The matrix gives priority, not truth. Scores are judgments, so write a clear definition for each severity and probability level, as the VA did, and use it the same way each time.

Matrices also leave out how easy a problem is to detect and what controls exist. HFMEA adds those with its decision tree.

Mix-up: there is no standard grid size, 4 by 4 or 5 by 5. And a risk matrix looks ahead at what could happen. The CMS scope and severity grid and [harm scales](https://incidentkit.ai/glossary/harm-scale) rate what already happened.

## Frequently asked questions

### Should we use a 4 by 4 or a 5 by 5 matrix?

Either can work. What matters is a written definition for every level, used the same way. The VA's SAC matrix has four severity and four probability levels.

### Is a risk matrix the same as the CMS scope and severity grid?

No. The CMS grid rates deficiencies already found on a nursing home survey. A risk matrix estimates the priority of a hazard or event from severity and likelihood.

### What is a risk matrix used for in incident management?

To decide which events get a full investigation, which are reviewed together and which go to leaders. The VA requires an individual RCA for sentinel events and events scored Actual 3 or Potential 3.

## Sources

- [DeRosier J, et al. Using Health Care Failure Mode and Effect Analysis: the VA National Center for Patient Safety's prospective risk analysis system. Jt Comm J Qual Improv, 2002](http://www.patientsafety.va.gov/docs/hfmea/HFMEA_JQI.pdf)
- [VHA National Center for Patient Safety: Root cause analysis (page and Guide to Performing a Root Cause Analysis, rev. 02/05/2021)](https://www.patientsafety.va.gov/professionals/onthejob/rca.asp)
- [VHA National Center for Patient Safety: Proactive risk assessment (HFMEA, fault tree analysis, hierarchy of actions)](https://www.patientsafety.va.gov/professionals/onthejob/hfmea.asp)
- [CMS State Operations Manual, Chapter 7: Survey and Enforcement Process for Skilled Nursing Facilities and Nursing Facilities](https://www.cms.gov/Regulations-and-Guidance/Guidance/Manuals/downloads/som107c07pdf.pdf)

## Related terms

- [Harm scale](https://incidentkit.ai/glossary/harm-scale)
- [Fault tree analysis](https://incidentkit.ai/glossary/fault-tree-analysis)
- [Root cause analysis](https://incidentkit.ai/glossary/root-cause-analysis)
- [Near miss](https://incidentkit.ai/glossary/near-miss)
- [PSIF (potential serious injury or fatality)](https://incidentkit.ai/glossary/psif)

## Related

- [Incident routing and escalation by severity](https://incidentkit.ai/product/routing-and-escalation)
- [Root cause analysis and CAPA: methods and strong actions](https://incidentkit.ai/guides/root-cause-analysis-and-capa-guide)
- [Incident reporting in healthcare: the complete guide](https://incidentkit.ai/guides/incident-reporting-in-healthcare)
- [Incident analytics: find the pattern before the next one](https://incidentkit.ai/product/analytics)
- [PSM incident investigation: 29 CFR 1910.119(m) explained](https://incidentkit.ai/compliance/osha/process-safety-incident-investigation)