How to Conduct a WSH Risk Assessment Matrix for bizSAFE Level 3 Application

Introduction

A WSH risk assessment matrix for bizSAFE Level 3 requires systematic hazard identification across every work activity, likelihood and severity rating on a 5×5 scale, risk ranking by calculated score, and documented control measures that are specific to your actual workplace operations. This structured approach is the core deliverable that MOM-approved auditors evaluate during the risk management implementation audit.

This guide covers the full process of developing a WSH risk assessment matrix for your bizSAFE Level 3 application in Singapore: from assembling your assessment team and identifying workplace-specific hazards, through risk evaluation and applying the hierarchy of controls, to producing audit-ready documentation. It does not cover broader topics such as ISO certifications, incident investigation procedures, or general workplace safety etiquette beyond what directly supports matrix development.

The target audience includes construction firms, manufacturing companies, contractors, subcontractors, and SMEs preparing for bizSAFE certification at Level 3. Whether you are a risk management champion leading the process internally or a senior management representative overseeing your company’s commitment to workplace safety and health, this guide provides the technical detail you need.

By the end of this article, you will understand:

  • How the 5×5 risk matrix structure works and how to apply it correctly

  • The five-phase assessment process from team formation through documentation

  • How to identify workplace-specific hazards across physical, chemical, ergonomic, and psychosocial categories

  • How to apply the hierarchy of controls and document risk control measures

  • What MOM-approved auditors expect and how to prepare audit-ready records

Understanding WSH Risk Assessment Matrix

The WSH risk assessment matrix is a semi-quantitative tool mandated under Singapore’s WSH (Risk Management) Regulations for evaluating workplace risks. It provides a systematic framework for rating each identified hazard according to two dimensions-likelihood and severity-and producing a numerical score that determines risk levels and priority for action. For Singapore businesses pursuing bizSAFE Level 3, this matrix forms the backbone of the risk management plan that auditors will scrutinize.

Matrix Components and Structure

Key elements of a risk assessment matrix include likelihood rankings and severity definitions, each rated on a 1–5 scale.

Likelihood scale:

Rating

Descriptor

Definition

1

Rare

Could occur only in exceptional circumstances

2

Remote

Could occur at some time but unlikely

3

Occasional

Might occur at some time

4

Frequent

Will probably occur in most circumstances

5

Almost Certain

Expected to occur in most circumstances

Severity scale:

Rating

Descriptor

Definition

1

Negligible

First-aid injury only

2

Minor

Medical treatment injury, short-term illness

3

Moderate

Serious injury requiring hospitalization

4

Major

Permanent disability, life-threatening condition

5

Catastrophic

Fatality or multiple major injuries

The Risk Prioritization Number (RPN) is calculated by multiplying Severity × Likelihood. Risk levels can be categorized as low, medium, or high based on likelihood and severity: scores of 1–6 are Low (green), 8–12 are Medium (amber), and 15–25 are High (red). This color-coding system enables rapid visual prioritization, ensuring resources are directed at the most critical workplace risks first.

Regulatory Framework

Risk management processes must comply with the WSH (Risk Management) Regulations under the Workplace Safety and Health Act, and employers need to understand their legal obligations under both requirements. These regulations require every employer, self-employed person, and principal-including contractors and subcontractors-to identify hazards, assess risks, take reasonably practicable steps to eliminate or reduce those risks, document findings, and communicate results to affected persons.

The Code of Practice on WSH Risk Management (RMCP, third revision, 2021) provides detailed guidance on implementing these risk management regulations, including recommended matrix structures, the hierarchy of controls, documentation standards, and review schedules. Within the broader bizSAFE programme, Level 3 audit requirements are built directly on these regulatory foundations: companies must engage a MOM-approved auditing organisation to verify that the risk management plan has been properly developed and implemented. The audit scope is based on the bizSAFE Level 3 checklist, and the resulting risk management audit report confirms compliance with these safety and health standards.

Understanding this regulatory framework is essential before applying for bizSAFE recognition and moving into the specific requirements of the bizSAFE Level 3 application itself.

bizSAFE Level 3 Application Context

Building on the regulatory requirements above, bizSAFE Level 3 translates those obligations into a structured step within the bizSAFE programme and a move toward formal bizSAFE recognition. It represents a critical milestone in the bizSAFE journey, moving from awareness and commitment (Levels 1 and 2) to demonstrated risk management implementation. bizSAFE Level 3 requires a valid bizSAFE Level 2 certification, meaning your CEO or board director must have already completed the top executive WSH programme before your company can proceed, and successful approval leads to a bizSAFE certificate that is typically valid for three years.

Risk Management Plan Requirements

A risk management plan must be developed for bizSAFE Level 3, including a documented RM plan for the audit. This involves developing comprehensive documentation that MOM-approved auditors will evaluate against specific criteria. The risk management implementation plan must include:

  • A complete inventory of all work activities and processes, covering both routine operations (production, maintenance, cleaning) and non-routine tasks (commissioning, repairs, process changes)

  • A risk register listing every identified hazard, its risk evaluation (severity and likelihood ratings), existing controls, additional controls planned, residual risk scores, responsible persons, and implementation timelines

  • A WSH policy statement demonstrating the company’s commitment to maintaining a safe and healthy environment

  • Evidence of RM team formation, including appointment of a risk management champion and team members

  • Documentation of worker consultation, showing that all employees must be consulted in the hazard identification process

The Risk Management Plan must be specific to your workplace-not a generic template adapted from another company. It must show how your company will conduct risk assessments for its actual operations, and the audit will verify that these reflect your equipment and working conditions.

Audit Preparation Considerations

An independent audit by a MOM-approved auditor is required for bizSAFE Level 3. You must engage a MOM-approved auditing organisation that can provide WSH auditing services and validate your risk management plan development. The audit typically takes one to two days to complete, during which auditors examine not only documents but also site practices.

Independent audits verify that the risk management plan is implemented on-site. This means auditors will look for:

  • Matrix presentation in clear, standardized forms within your risk register

  • Supporting evidence such as photos, training records, inspection logs, and PPE issue records

  • Workplace-specific customization demonstrating that you conducted proper risk assessments rather than copying generic risk assessments from templates

  • Interviews with workers confirming awareness of hazards and control measures

Common audit failures include generic risk assessments and missing training records. The Risk Management Audit Report is valid for three years from the audit date, and the certification is valid for three years from approval. Understanding the full audit requirements early allows you to build documentation that satisfies these expectations from the start.

Common Industry Applications

The risk assessment matrix applies differently across sectors, though the methodology remains consistent:

Construction: Typical hazards include work at height (scaffolding, roof works, tower cranes), excavation with trench collapse risks, falling objects, electrical hazards, and heat stress. For example, working at 10 metres without guardrails might receive a severity rating of 5 (Catastrophic) and a likelihood of 4 (Frequent) without controls-producing an RPN of 20, firmly in the High-risk category. Construction-specific risk assessments must reflect the dynamic nature of these worksites.

Manufacturing: Key hazards include unguarded machinery (entanglement, crushing), chemical handling and spill exposure, confined space entry, and ergonomic hazards from manual lifting or repetitive tasks. A manufacturer that installed machine guards and implemented lock-out-tag-out procedures might reduce an entanglement hazard from High to Medium risk.

SMEs and services: Lifting heavy items, slips and trips on wet floors, worker fatigue, noise exposure, and chemical hazards in cleaning operations are common concerns, along with contractor interface risks.

With this context established, the following section details the step-by-step process for developing your risk matrix.

Step-by-Step Matrix Development Process

Developing a WSH risk assessment matrix for bizSAFE Level 3 involves a structured five-phase process. Risk assessment should cover all work activities, not just high-risk tasks. Each phase builds on the previous one, creating a comprehensive and auditable body of documentation that demonstrates your company’s actual implementation of risk management.

Phase 1: Workplace Assessment and Team Formation

A multidisciplinary team should be involved in the risk assessment process. Before any hazard can be evaluated, you need the right people and the right information.

  1. Assemble the RA team: Include senior management representatives, safety officers, supervisors, operations managers, frontline workers, and technical or engineering staff. The RM team leader should have completed a MOM-approved risk management course. Consider engaging an external consultant if internal expertise is limited.

  2. Conduct a comprehensive workplace walkthrough: Document every work area, process, piece of equipment, and material in use. Photograph conditions, note environmental factors (ventilation, lighting, noise levels, exposure to weather), and map traffic flow and worker movement patterns.

  3. Review historical data: Examine past incident reports, near-miss records, workers’ compensation claims, and previous risk assessments. This data provides objective evidence for likelihood ratings later.

  4. Catalogue all work activities: Create a complete inventory distinguishing routine activities (daily production runs, scheduled maintenance, housekeeping) from non-routine ones (equipment commissioning, emergency repairs, process changeovers). Risk assessments must be conducted for all work activities.

Phase 2: Hazard Identification and Documentation

The risk assessment matrix evaluates physical, chemical, ergonomic, and psychosocial hazards. Systematic hazard identification must cover all categories recognized under the RMCP:

  • Physical hazards: Machinery with moving parts, work at height, electrical systems, noise, vibration, slippery surfaces, falling objects

  • Chemical hazards: Toxic substances, flammable materials, corrosive agents, dust, fumes

  • Biological hazards: Disease exposure, insect vectors (dengue risk is relevant in Singapore’s tropical climate), contamination risks

  • Ergonomic hazards: Manual handling of heavy loads, repetitive motion tasks, awkward postures, prolonged standing

  • Psychosocial hazards: Excessive work hours, fatigue, workplace stress, communication barriers (particularly relevant for migrant worker populations)

All employees must be consulted in the hazard identification process. Use structured checklists from MOM or the WSH Council, including guidance published by the Workplace Safety and Health Council as an authoritative Health Council reference, conduct worker interviews, review safety committee feedback, and incorporate contractor input. For each identified hazard, document: the hazard source, who is exposed, the exposure route, duration and frequency, and potential consequences including the type and severity of possible injury or illness.

Singapore-specific considerations are essential. Heat stress from the tropical climate, high humidity affecting grip and concentration, heavy rainfall creating wet surfaces, and site conditions in densely built environments should all feature in your hazard identification to support a safer and healthier workplace.

Risk Evaluation Matrix Application

With hazards identified, apply the 5×5 risk matrix to evaluate each one. The following table illustrates the matrix structure:

Likelihood ↓ / Severity →

1 Negligible

2 Minor

3 Moderate

4 Major

5 Catastrophic

5 Almost Certain

5

10

15

20

25

4 Frequent

4

8

12

16

20

3 Occasional

3

6

9

12

15

2 Remote

2

4

6

8

10

1 Rare

1

2

3

4

5

Risk classification bands:

  • High risk (15–25): Immediate action required; work should not proceed until controls are in place

  • Medium risk (8–12): Action required within defined timeframe; additional controls needed

  • Low risk (1–6): Acceptable with existing controls; monitor and maintain

Calculation examples:

  • Working at height without guardrails: Severity = 5 (Catastrophic), Likelihood = 4 (Frequent without controls) → RPN = 20 → High risk

  • Handling cleaning chemicals with gloves already provided: Severity = 3 (Moderate), Likelihood = 3 (Occasional) → RPN = 9 → Medium risk

  • Office slip hazard with anti-slip mats installed: Severity = 2 (Minor), Likelihood = 2 (Remote) → RPN = 4 → Low risk

Calculate both the initial RPN (before additional controls) and the residual risk (after implementing planned controls). Your risk management audit report must demonstrate measurable risk reduction between these two scores.

Control Measures Development

Hierarchy of Controls prioritizes eliminating hazards before using PPE, linking control implementation to broader health system management. Control measures must be documented and implemented in order of effectiveness according to the hierarchy of controls:

  1. Elimination: Remove the hazard entirely. Redesign a process to avoid working at height, eliminate a hazardous chemical from the workflow, or automate a dangerous manual task.

  2. Substitution: Replace with something less hazardous. Use a water-based solvent instead of a volatile organic compound, or replace a noisy machine with a quieter model.

  3. Engineering controls: Physically isolate workers from hazards. Install machine guards, ventilation systems, guardrails, sound barriers, or interlocking safety devices.

  4. Administrative controls: Change the way people work. Develop safe work procedures, implement permit-to-work systems, establish emergency procedures, provide training, rotate shifts to reduce exposure, install signage, and maintain housekeeping standards.

  5. Personal protective equipment: Use PPE as the last line of defense when other controls cannot fully eliminate risk. Selection must match the specific hazard, and workers need proper fit testing, maintenance protocols, and training on correct use.

Each identified hazard must have a designated responsible person for control measures. Assign clear ownership, set implementation deadlines, allocate resources, and document both existing controls and additional measures planned. Where elimination or substitution is not practicable, document the justification-auditors expect to see reasoning, not just a default jump to administrative controls or PPE.

For detailed guidance on developing your risk register and documenting controls, ensure each entry includes the before-and-after RPN to demonstrate measurable risk reduction.

Common Challenges and Solutions

Even well-intentioned organizations encounter predictable obstacles when developing their risk matrix for bizSAFE Level 3. Recognizing these challenges early helps you avoid the most common reasons for audit delays or failures.

Generic or Copied Assessments

Generic risk assessments are a common reason for audit failure. Auditors immediately recognize boilerplate language, vague hazard descriptions, and risk entries that do not reflect your actual workplace conditions. Using a generic template downloaded from the internet signals that your organization has not conducted proper risk assessments.

Solution: Conduct workplace-specific assessments reflecting your actual operations, equipment types, workforce composition, and environmental conditions. Include site photos, reference specific machinery models by name, document actual chemical products in use, and name the positions responsible for each control measure. Your risk assessment must be specific to actual workplace conditions-this is a non-negotiable requirement.

Incomplete Hazard Identification

Incomplete hazard identification is a frequent audit finding. Organizations often focus exclusively on obvious physical hazards while overlooking ergonomic hazards (manual handling, repetitive strain), psychosocial hazards (fatigue, stress), occupational health exposures (noise-induced hearing loss, chemical sensitization), and environmental factors unique to Singapore’s climate.

Solution: Use systematic checklists covering all hazard categories from MOM and the WSH Council guidelines. Involve frontline workers directly-they experience hazards daily that supervisors may not observe. Review industry-specific guidance, incident histories, and near-miss reports. Consider using digital hazard-finding tools such as those provided by the Institution of Engineers Singapore (IEH).

Inadequate Risk Evaluation

Inconsistent severity or likelihood ratings, failure to document the rationale behind scores, overdependence on a single person’s subjective judgment, and neglecting to account for existing controls when setting initial ratings all undermine the credibility of your risk evaluation.

Solution: Define rating scales clearly within your documentation, providing concrete examples for each level relevant to your industry. Use historical incident data and industry benchmarks to support ratings. Require at least two team members to independently evaluate each hazard before reconciling differences. Document why a particular rating was chosen, not just the number itself.

Weak Control Measure Selection

Organizations frequently default to administrative controls or personal protective equipment even when higher-order controls (elimination, substitution, engineering) are feasible. Other common weaknesses include missing implementation timelines, absent responsible parties, and no evidence that controls were actually implemented.

Solution: Follow the hierarchy of controls systematically and document justification where elimination or substitution is not practicable-citing cost, technical feasibility, or operational constraints. Ensure each control measure is specific, measurable, assigned to a named person, realistic, and time-bound. Monitor actual implementation and record evidence. Show that residual risk has been reduced to an acceptable level, with rationale documented.

These challenges are avoidable with disciplined preparation, and addressing them proactively strengthens both your audit outcome and your workplace safety culture.

Conclusion and Next Steps

Effective WSH risk assessment matrix development for bizSAFE Level 3 demands systematic hazard identification across every work activity, consistent risk evaluation using a properly structured 5×5 matrix, and workplace-specific control measures documented with clear ownership and timelines. Risk factors must be regularly updated after incidents or changes in work processes, and risk assessments must be reviewed every 3 years or when changes occur. Risk assessments must also be communicated to all affected workers in an understandable language to ensure the controls are actually followed on the ground.

The business case extends beyond compliance, because Level 3 supports ongoing bizSAFE recognition and can culminate in a valid bizSAFE certificate. bizSAFE Level 3 is essential for government tenders in Singapore, and bizSAFE certification increases business opportunities for contracts and tenders. Beyond the commercial advantages, participation in the bizSAFE programme can strengthen both tender eligibility and corporate credibility, support better corporate branding, and help maintain the company’s bizSAFE status through disciplined review and renewal practices, while the process itself helps meet legal obligations and builds a safer and healthier workplace. Companies with bizSAFE certification can advertise for free on the bizSAFE Marketplace, providing an additional business competitive edge.

Immediate action steps:

  1. Confirm your bizSAFE Level 2 certification (including CEO or board director completion of the executive WSH programme) is current

  2. Assemble your multidisciplinary risk assessment team and appoint a risk management champion

  3. Conduct a full workplace survey and inventory all work activities

  4. Complete your risk matrix documentation with workplace-specific hazard identification, risk evaluation, and control measures

  5. Engage a MOM-approved auditing organisation to schedule your risk management audit-budget for audit fees and allow one to two days for the on-site review

  6. After certification, schedule reviews within the three-year validity period or whenever work processes change

For organizations looking to progress further, consider advancing from bizSAFE Level 3 to Level 4, which involves developing a health management system (WSH Management System). Ongoing risk management plan maintenance, safe work procedure development, and regular reviews will strengthen your safety culture well beyond the certification itself, and some companies may later encounter broader frameworks such as the Green Management Assessment Scheme where they align with wider management systems.

Additional Resources

Tags

What do you think?

Leave a Reply

Your email address will not be published. Required fields are marked *

Related Articles