Risk Assessment Matrix for Nursing QI Projects: A 5×5 Guide

Risk assessment matrix for nursing QI projects is a practical way to identify what could prevent an improvement project from being safe, feasible or successful. For nursing students, the matrix is especially useful when an assignment asks you to show how project risks will be identified, scored, controlled and reviewed rather than simply listing possible problems.

A risk matrix usually combines two judgements: how likely a risk is to occur and how serious the consequence would be if it occurred. NHS England notes that health and care organisations commonly use a matrix approach based on a likelihood × consequence model, often displayed as a 5×5 grid (National Quality Board [NQB], 2024). The important point is that the score supports structured judgement. It does not replace professional judgement, local policy or clinical escalation.

This guide shows nursing students how to build a 5×5 matrix, create a project risk register, calculate initial and residual risk, and explain the method in a quality improvement (QI) assignment, dissertation, capstone or service-improvement project.

What is a risk assessment matrix in a nursing QI project?

A risk assessment matrix is a structured table used to compare risks according to their likelihood and consequence. It helps a team decide which risks need immediate action, which can be monitored and which may be acceptable within local governance arrangements.

Risk management is broader than the matrix itself. ISO 31000 describes risk management as a process that includes identifying, analysing, evaluating, treating, monitoring and communicating risk (International Organization for Standardization [ISO], 2018). The matrix sits mainly within the analysis and evaluation stages.

For a nursing QI project, the matrix can be used to assess risks such as:

• the proposed change increasing documentation burden;
• staff being unable to use a new process reliably;
• a change creating an unintended patient-safety problem;
• poor-quality data leading to misleading conclusions;
• confidential information being exposed during data collection;
• patients with communication or accessibility needs being excluded;
• equipment or digital systems being unavailable;
• implementation varying between day and night shifts;
• the intervention disrupting another important clinical process; and
• the project failing because responsibilities, escalation or review arrangements are unclear.

This is different from an individual patient risk assessment. A QI project matrix normally evaluates risks associated with the improvement work, its implementation and its effects on the service. It should not be used as a substitute for validated clinical tools, safeguarding procedures or individualised clinical assessment.

Risk assessment matrix versus a fishbone diagram

The two tools answer different questions. A fishbone diagram asks, “What might be contributing to the problem?” A risk matrix asks, “Which identified risks are most important to manage, given their likelihood and potential consequence?”

For example, a fishbone analysis of delayed pain reassessment may suggest interruptions, unclear responsibility, documentation design and competing workload as possible contributory factors. The project team might then design a new reminder process. A risk matrix can be used to assess the risks introduced by that change, such as alert fatigue, duplication of documentation or missed escalation when staff assume the reminder system will identify every problem.

If you need the diagnostic tool first, see our fishbone diagram healthcare example for nursing QI. For the full improvement sequence, see how to write a nursing quality improvement project.

How to calculate a risk score

A common 5×5 approach uses the following formula:

Risk score = Likelihood score × Consequence score

If a risk is assessed as likely to occur, with a likelihood score of 4, and the potential consequence is major, with a consequence score of 4, the score is:

4 × 4 = 16

NHS England provides an example using the same likelihood × consequence approach, while North West Ambulance Service describes a 5×5 matrix in which both likelihood and consequence are scored from 1 to 5 (NQB, 2024; North West Ambulance Service NHS Trust [NWAS], 2024).

Do not assume that every university, NHS organisation or healthcare provider uses identical colour bands or escalation thresholds. Use the scoring system supplied in your module, placement organisation or local risk-management policy. If none is supplied and you create an academic example, state clearly that your thresholds are illustrative.

5×5 risk assessment matrix for nursing QI projects

The table below shows the numerical structure of a standard 5×5 matrix. It deliberately displays the scores rather than claiming that one universal set of colours applies everywhere.

Likelihood ↓ / Consequence →	1 Insignificant	2 Minor	3 Moderate	4 Major	5 Catastrophic
5 Almost certain	5	10	15	20	25
4 Likely	4	8	12	16	20
3 Possible	3	6	9	12	15
2 Unlikely	2	4	6	8	10
1 Rare	1	2	3	4	5

Figure-style interpretation is simple: risks in the upper-right area have both higher likelihood and higher consequence, so they generally demand greater attention. Risks in the lower-left area are less likely and less consequential. However, the score should never be interpreted in isolation. A rare but catastrophic event may still require strong controls, while a frequent low-consequence problem may create substantial cumulative burden.

Step 1: define the risk clearly

Weak risk statements are vague. “Staff resistance” or “poor communication” does not tell the reader what may happen or why it matters. A clearer format is:

There is a risk that [event] because of [cause or condition], which may lead to [consequence].

For example:

There is a risk that the new electronic pain-reassessment prompt will be ignored because staff already receive multiple alerts, which may lead to unreliable use of the intervention and missed reassessment opportunities.

NHS England similarly recommends describing the risk, its cause and the potential impact so that the assessment is based on an explicit scenario rather than a vague label (NQB, 2024).

Step 2: score likelihood

Likelihood asks how probable the defined event is within the relevant period. A common 1-to-5 structure is rare, unlikely, possible, likely and almost certain. NWAS uses a 5-point likelihood scale as part of its organisational risk matrix (NWAS, 2024).

For a student QI project, avoid inventing probabilities. If local audit or incident data are available, use them. If the project is hypothetical, explain the basis of your judgement. You might state that likelihood was estimated using the supplied case information, staff consultation, pilot observations or published evidence. Where no empirical data are available, label the score as provisional and subject to review.

Step 3: score consequence

Consequence asks what would happen if the defined risk occurred. A 5-point scale often ranges from insignificant to catastrophic, but the detailed definitions should come from the relevant local policy.

In nursing QI, consequence should be considered across more than direct physical harm. Depending on the project, relevant consequences may include:

• patient safety;
• quality or continuity of care;
• privacy and confidentiality;
• service disruption;
• staff workload;
• inequality or exclusion;
• regulatory or governance requirements;
• data integrity; and
• failure to achieve the improvement aim.

If a risk could have several consequences, use the most credible serious consequence supported by the scenario and local guidance. Do not inflate the score simply to make a risk look important.

Step 4: record existing controls before adding new actions

A control is something already in place that reduces either the likelihood or consequence of the risk. Controls should be specific and observable. “Staff will be careful” is not a meaningful control.

Better examples include:

• role-based access to the project dataset;
• de-identification before analysis;
• a standard operating procedure for the new workflow;
• brief competency-based training before implementation;
• a named clinical escalation route;
• a small pilot on one shift before wider rollout;
• daily review during the first week of testing;
• a balancing measure for documentation time; and
• a downtime procedure if the digital system is unavailable.

The NMC Code requires nurses to preserve safety, share information to identify and reduce risk, act when patient safety is threatened and work within their competence (Nursing and Midwifery Council [NMC], 2018). A QI risk register should therefore show practical responsibility for safety, not just numerical scoring.

Step 5: calculate residual risk

Initial risk, sometimes called inherent or pre-control risk, describes the level of risk before the planned control or additional action is applied. Residual risk describes the risk remaining after controls are considered.

Suppose alert fatigue is initially scored likelihood 4 × consequence 3 = 12. The team introduces a targeted prompt limited to eligible patients, removes a duplicate alert and reviews alert response during a two-shift pilot. After these controls, the likelihood might reasonably fall from 4 to 2 while the consequence remains 3. The residual score becomes 6.

The arithmetic alone does not prove the risk has fallen. The revised score should be justified by evidence from the pilot or review. If no post-control data exist yet, describe the residual score as an anticipated or target residual risk rather than a confirmed result.

Worked risk assessment matrix example for a nursing QI project

Imagine a medical ward QI project testing an electronic prompt to improve timely pain reassessment after analgesia. The project team has already defined its improvement aim and process measure. Before the pilot, it develops the following risk register.

Risk	L	C	Initial score	Planned control	Residual L	Residual C	Residual score
Prompt ignored because of alert fatigue, reducing intervention reliability	4	3	12	Limit prompt to eligible cases; remove duplicate alerts; pilot on one team	2	3	6
Duplicate documentation increases nursing workload	3	2	6	Map current documentation and replace, rather than add, a duplicate field	2	2	4
Patient information becomes visible to unauthorised people	2	4	8	Use role-based access, minimum necessary data and de-identified project extracts	1	4	4
Night-shift adoption is lower than day-shift adoption	4	3	12	Include night staff in design and pilot testing; measure uptake by shift	2	3	6
System downtime prevents staff seeing the prompt	2	3	6	Agree a simple downtime process and avoid making the prompt the only safety mechanism	1	3	3
Patients with communication needs are less likely to have pain reassessed appropriately	2	4	8	Include accessible pain-assessment routes and test the process with relevant patient groups	1	4	4

Important: these scores are an academic illustration, not a universal NHS threshold. In a real project, the team would use the organisation’s approved descriptors, escalation rules and risk appetite.

How to turn the matrix into a complete nursing QI risk register

The matrix gives you a score, but a risk register makes the assessment usable. A strong nursing QI risk register usually contains:

Field	What to record
Risk ID	A simple reference number.
Risk statement	The event, cause and potential consequence.
Evidence/source	Audit, incident data, observation, staff feedback, literature or scenario information.
Likelihood	Score and descriptor using the chosen framework.
Consequence	Score and descriptor using the chosen framework.
Initial score	Likelihood × consequence.
Existing controls	Controls already operating before new actions.
Further actions	What additional action is required.
Owner	The person or role responsible for the action.
Review date	When the risk will be reassessed.
Residual score	The remaining risk after controls, supported by review evidence.

This structure shows markers that you understand risk management as an active process rather than a one-off table completed at the start of the project.

Where risk assessment fits in PDSA testing

Risk assessment should continue as the project develops. A small PDSA test may reveal a risk that was not visible during planning. For example, the team may discover that an electronic reminder works well during day shifts but creates duplicate work overnight. That new information should update the risk register and the next PDSA cycle.

A practical sequence is:

1. Identify project and implementation risks before the first test.
2. Score and prioritise them using the approved matrix.
3. Introduce proportionate controls.
4. Test the change on a small scale.
5. Collect outcome, process and balancing data.
6. Review whether risks changed or new risks appeared.
7. Update the register before wider implementation.

For a detailed explanation of iterative testing, see our nursing PDSA cycle guide.

How to write the risk assessment section in a nursing assignment

A good academic paragraph explains the method, not just the final score. You could write:

A 5×5 risk assessment matrix was used to evaluate implementation risks according to likelihood and consequence. Each risk was written as an explicit event-cause-impact statement and scored before additional controls were proposed. The initial score was calculated by multiplying likelihood by consequence. Controls were then linked to specific risks, with residual scores identified for reassessment during PDSA testing. Local organisational descriptors would take precedence over the illustrative thresholds used in this academic project.

Then discuss the highest-priority risks in the main text. Do not repeat every row of the table in prose. Instead, explain why the most important risks matter, how the controls address them and what data will show whether the controls work.

Common mistakes nursing students make with risk matrices

• Scoring the QI problem instead of the project risk. If your project is about falls, the risk register should not simply repeat “patients may fall”. It should examine risks linked to the proposed change and implementation.
• Using scores without definitions. State what 1 to 5 means for both likelihood and consequence.
• Copying colour thresholds from another organisation. Risk bands and escalation rules are locally defined.
• Inventing frequency data. If you do not have local evidence, describe the score as an informed estimate.
• Confusing controls with outcomes. “Fewer falls” is an outcome, not a control.
• Assuming training solves every risk. Redesign workflow, technology, roles and environment where appropriate.
• Ignoring balancing risks. An intervention can improve one measure while worsening workload, delays or equity.
• Failing to assign an owner. An action without responsibility is difficult to implement or review.
• Failing to reassess. Residual risk should be reviewed after controls are tested.
• Treating the matrix as objective truth. Numerical scoring still depends on judgement and evidence quality.

Limitations of the risk assessment matrix

Risk matrices are useful because they make assumptions visible and support consistent discussion, but they have limitations. Kaya, Ward and Clarkson (2019) reviewed risk matrices used in acute hospitals in England and found substantial variation in their design and guidance. Some designs could increase the chance of misprioritising risks.

This matters in student work. Two risks can receive the same numerical score even when their clinical meaning is different. A score of 10 could arise from likelihood 5 × consequence 2 or likelihood 2 × consequence 5. The first describes a frequent lower-consequence event; the second describes a less frequent but much more serious event. They should not automatically be managed in the same way.

Use the matrix as a decision-support tool. Combine it with local data, patient and staff perspectives, professional judgement, governance requirements and an explicit description of uncertainty. ISO 31000 also emphasises that risk management should be tailored to context and continually reviewed rather than treated as a static calculation (ISO, 2018).

Frequently asked questions

What is a 5×5 risk matrix in nursing?

It is a table that scores likelihood from 1 to 5 and consequence from 1 to 5, producing a combined score from 1 to 25. Local policies determine the detailed descriptors, risk bands and escalation requirements.

What is the formula for a nursing QI risk score?

A common formula is likelihood × consequence. For example, likelihood 3 multiplied by consequence 4 gives a score of 12.

Should a student use a risk matrix before or after PDSA?

Both. Identify and control foreseeable risks before the first test, then review the matrix after each meaningful PDSA cycle because implementation may reveal new risks or change existing scores.

What is residual risk?

Residual risk is the risk that remains after controls or mitigation have been applied. It should be reassessed rather than assumed to be lower.

Is a risk matrix the same as a risk register?

No. The matrix provides the scoring framework. The risk register records each risk, evidence, scores, controls, actions, owner, review date and residual risk.

Can I use a 5×5 matrix in a nursing dissertation or capstone?

Yes, when it is relevant to a QI, implementation, service-improvement or capstone project. Explain the scoring method, identify the source of the descriptors and avoid presenting illustrative scores as real clinical data.

Related Nursing Guides

• How to Conduct a Critical Appraisal in Nursing Research: CASP, JBI and Other Tools
• How to Write Recommendations in a Nursing Dissertation: Examples and Structure

Conclusion

A risk assessment matrix for nursing QI projects is most useful when it turns a vague list of concerns into a transparent management process. Define each risk clearly, score likelihood and consequence using an approved framework, document existing controls, plan further actions, assign responsibility and review residual risk as the project develops. The 5×5 table is only one part of the process. Strong nursing QI work combines the matrix with evidence, professional judgement, patient-safety principles, balancing measures and repeated review during implementation.

If your project is part of a nursing capstone, dissertation or service-improvement assessment, you can also review our nursing capstone project support and nursing dissertation support services.

References

• International Organization for Standardization. (2018). ISO 31000:2018 Risk management – Guidelines. ISO. https://www.iso.org/standard/65694.html
• Kaya, G. K., Ward, J., & Clarkson, J. (2019). A review of risk matrices used in acute hospitals in England. Risk Analysis, 39(5), 1060-1070. https://doi.org/10.1111/risa.13221
• National Quality Board. (2024). Principles for assessing and managing risks across integrated care systems. NHS England. https://www.england.nhs.uk/long-read/principles-for-assessing-and-managing-risks-across-integrated-care-systems/
• North West Ambulance Service NHS Trust. (2024). Risk management policy. https://www.nwas.nhs.uk/publications/risk-management-policy/
• Nursing and Midwifery Council. (2018). The Code: Professional standards of practice and behaviour for nurses, midwives and nursing associates. NMC. https://www.nmc.org.uk/standards/code/