Method guide

Occupational risk assessment: choosing a method and calculating risk correctly

An occupational risk assessment is a structured identification of hazards at a workstation, an estimate of the likelihood and severity of harm, and a decision on whether the risk is acceptable and which controls are needed. Polish law requires risk to be assessed and documented but does not prescribe a single method — the most common are PN-N-18002, the 5×5 matrix and the Fine-Kinney Risk Score.

The method is not the goal. A good assessment can be repeated, separates risks well enough to set priorities and ends with concrete actions, not just a number in a table.

Risk assessment
Risk matrix
Risk Score
Fine-Kinney

Published: 2026-10-04 · Updated: 2026-10-04 · 12 min · Varilo deployment team

VIMS EHS — Safety specialist and press operator reviewing an occupational risk assessment with a risk matrix on a tablet — Safety specialist and press operator reviewing an occupational risk assessment with a risk matrix on a tablet

Employer duties in brief

The Polish Labour Code (Art. 226) requires employers to assess and document occupational risk, apply the necessary preventive measures and inform employees about the risk. Details, including taking all workplace factors and the way work is performed into account, are set out in the regulation on general health and safety rules.

The law does not prescribe an estimation method. The employer chooses it, but it should be described in the documentation and applied consistently. This article is guidance, not legal advice; confirm obligations for a specific site with your safety professional.

VIMS EHS — Comparison of occupational risk assessment methods: PN-N-18002 table, 5×5 matrix and Fine-Kinney Risk Score — The three most common risk assessment methods and their calculation rules (labels in Polish).

Five steps of a risk assessment

1. Gather information about the workstation: tasks, machines, substances, working time and the people doing the work (including those with special status). 2. Identify hazards — on site, with the worker, not from a desk. 3. Estimate risk with the chosen method for each hazard, taking existing controls into account. 4. Decide on acceptability and plan actions following the hierarchy: elimination, substitution, engineering, administrative controls, PPE. 5. Document, inform employees and set a review date.

The most common failure is skipping step 4 in practice: the risk is calculated, but the controls “to be implemented” have no owner or deadline. The assessment is then formally correct and operationally useless.

The PN-N-18002 method: three levels, quick result

The method based on the Polish standard PN-N-18002 rates severity (low, medium, high) and likelihood (unlikely, likely, highly likely). The result is read from a table: low, medium or high risk. High risk is unacceptable, medium is acceptable with a reduction plan, low is acceptable.

Its strengths are simplicity and familiarity among inspectors and safety staff. Its weakness is poor differentiation: many hazards land in “medium”, making it hard to decide what to do first. The standard also describes a five-level variant that partly solves this.

The 5×5 matrix: R = L × S

Likelihood (L) and severity (S) are rated 1–5 and risk is the product R = L × S, ranging from 1 to 25. Typical bands: 1–4 low, 5–9 medium, 10–15 high, 16–25 very high. The organisation sets the bands and scale descriptions — what matters is that they are written down and understood the same way by every assessor.

Example: a fall when climbing onto a press platform without a handrail. Severity: serious injury with lost time, S = 4. Likelihood: several times per shift on oily steps, L = 3. R = 12 — high, action required within a set deadline. After fitting a handrail and anti-slip matting, L drops to 1 and R = 4 — low.

The matrix suits risk registers in management systems (ISO 45001, ISO 9001, ISO 22000) because the same language works for safety, quality and food safety.

VIMS EHS — 5×5 risk matrix with values 1–25 colour-coded as low, medium, high and very high risk — Example 5×5 matrix: risk is likelihood multiplied by severity. Bands are set by the organisation (labels in Polish).

Risk Score (Fine-Kinney): R = S × E × P

Risk Score adds a third factor — exposure (E), meaning how often the worker meets the hazard. Severity (S) runs from 1 (minor injury) to 100 (catastrophe, multiple fatalities), exposure from 0.5 (very rare) to 10 (continuous) and probability from 0.1 (practically impossible) to 10 (expected).

Typical interpretation: below 20 — negligible or low; 20–70 — possible, needs attention; 70–200 — substantial, correction needed; 200–400 — high, immediate improvement; above 400 — very high, consider stopping work. Example: cleaning a shaft without isolating energy, S = 15, E = 6 (daily), P = 3 (quite possible), R = 270 — high; a LOTO procedure lowers P to 0.5 and R to 45.

Risk Score separates risks very well and shows the effect of task frequency, but needs trained assessors — the wide scale invites differences between people.

How VIMS supports occupational risk assessment

The VIMS risk assessment module keeps workstation records in your chosen method, with change history and review dates. An AI assistant suggests typical hazards and controls for the described workstation — a person always reviews and approves the suggestions.

The assessment is connected to the rest of the system: substances from the chemical substances and SDS register, incidents and reports, CAPA actions and technical changes can signal that a record needs review. Controls become tasks with an owner and a deadline, and employees confirm they have read the record. Before field work, the team runs a short LMRA on a phone to check that conditions match the assessment.

Glossary: hazard, risk, severity, likelihood and hierarchy of controls

Hazard vs risk — a hazard is a source of potential harm (moving parts, noise, a chemical); risk combines the likelihood of harm with its severity. The same noise gives a different risk at different exposure times.

Dangerous, harmful and onerous factors — dangerous factors can cause injury, harmful ones disease (dust, noise, chemicals), onerous ones fatigue without lasting harm. A risk assessment covers all three.

PN-N-18002:2011 — the Polish standard with general guidance on occupational risk assessment, offering a three-level (low, medium, high) or five-level scale. It is voluntary; an employer may use another documented method.

5×5 risk matrix — R = L × S, likelihood times severity, each scored 1–5. Results are grouped into risk levels with defined actions.

Risk Score (Fine–Kinney method) — R = S × E × P, where E is exposure frequency. It differentiates well between rare and continuous tasks.

Acceptable risk, residual risk and re-estimation — after planning controls, risk is estimated again; the residual value decides whether work may continue.

Hierarchy of controls — elimination, substitution, engineering and collective protection, administrative controls and finally PPE. Templates and methods are available in the occupational risk assessment module.

Comparison of risk assessment methods

No method is “best” — what matters is fit for the site and consistent use.

Criterion	PN-N-18002 (3 levels)	5×5 matrix	Risk Score (Fine-Kinney)
Formula / approach	Read from a 3×3 table	R = L × S	R = S × E × P
Result range	Low / medium / high	1–25	From fractions to several thousand
Risk differentiation	Weak	Good	Very good
Accounts for frequency	Indirectly via likelihood	Indirectly via likelihood	Yes, separate factor E
Ease of learning	Very easy	Easy	Requires training
Good fit	Small firms, simple workstations	Integrated QHSE systems, risk registers	Manufacturing, maintenance, high-risk work

Key takeaways

The law requires assessment and documentation, not a specific method.
Write the method and acceptability bands into a procedure and apply them consistently.
Identify hazards at the workstation, together with the worker.
Estimate risk with the controls that actually work.
Every control to be implemented needs an owner and a deadline.
After implementing controls, calculate the residual risk.
Review after changes and incidents, not only once a year.

Related modules

Occupational risk assessment

Risk assessment — a living document instead of a binder

Run risk assessment online: hazards, risk levels, control measures and reviews in one place, connected to what actually happens on site.

Explore the VIMS EHS module: Occupational risk assessment with AI

LMRA

LMRA — the last check before anyone picks up a tool

A job risk assessment describes a workplace under typical conditions. LMRA answers a different question: is this work safe here, right now, with this crew?

Explore the VIMS EHS module: LMRA — pre-task risk check

Frequently asked questions

Which risk assessment method should I choose?

PN-N-18002 is enough for simple workstations. The 5×5 matrix works well in integrated management systems. Risk Score is worth using where exposure frequency matters and priorities must be set precisely, e.g. in manufacturing and maintenance.

Can one site use different methods?

Yes, deliberately — e.g. PN-N-18002 for offices and Risk Score for the shop floor. The rules must be documented, and results from different methods should not be compared directly.

Who should carry out the risk assessment?

The employer is responsible. In practice a team does it: the safety professional, the supervisor, a worker from the workstation and, where needed, maintenance or a chemicals specialist.

Can AI do the risk assessment for me?

AI speeds the work by suggesting hazards and controls, but it does not know your workstation. A person who has seen the workplace always reviews and approves the final assessment.

Is PN-N-18002 mandatory?

No. Polish standards are voluntary unless a regulation explicitly references them. An employer may use PN-N-18002, a 5×5 matrix, Risk Score or another method, provided it is documented, applied consistently and leads to actions.

What is the difference between a hazard and a risk?

A hazard is a source of potential harm, such as work at height. Risk is how likely and how severe the harm is in specific conditions — with guardrails, harnesses and trained staff it differs from the same task without them.

What document should a risk assessment produce?

A documented assessment for each workstation, usually as a record covering the task, identified hazards, estimated risk, existing and planned controls and confirmation that workers were informed.

See risk assessment in VIMS

We will show how to keep workstation records in your chosen method, use AI suggestions and connect the assessment with incidents, chemicals and CAPA actions.

Book a demo Knowledge base