What does “Risk matrix” mean?
Short answer
A risk matrix scores a hazard by crossing how bad the outcome could be with how likely it is. The score sets which problems to fix first.
Also known as: risk assessment matrix, severity and probability matrix, Safety Assessment Code matrix
How it works
The VA National Center for Patient Safety built a Safety Assessment Code (SAC) matrix to rank adverse events and close calls. Staff pick a severity and a probability and read the score from the grid.
| Severity | Probability |
|---|---|
| Minor | Remote: sometime in 5 to 30 years |
| Moderate | Uncommon: sometime in 2 to 5 years |
| Major | Occasional: several times in 2 years |
| Catastrophic | Frequent: several times in 1 year |
For RCA, SAC scores run from 1 to 3. The VA requires an RCA for a sentinel event or a high-probability near miss scored Actual 3 or Potential 3.
The related HFMEA hazard matrix scores from 1 to 16. A hazard score of 8 or higher goes on to a decision tree.
Limits
The matrix gives priority, not truth. Scores are judgments, so write a clear definition for each severity and probability level, as the VA did, and use it the same way each time.
Matrices also leave out how easy a problem is to detect and what controls exist. HFMEA adds those with its decision tree.
Mix-up: there is no standard grid size, 4 by 4 or 5 by 5. And a risk matrix looks ahead at what could happen. The CMS scope and severity grid and harm scales rate what already happened.
Frequently asked questions
Should we use a 4 by 4 or a 5 by 5 matrix?
Either can work. What matters is a written definition for every level, used the same way. The VA's SAC matrix has four severity and four probability levels.
Is a risk matrix the same as the CMS scope and severity grid?
No. The CMS grid rates deficiencies already found on a nursing home survey. A risk matrix estimates the priority of a hazard or event from severity and likelihood.
What is a risk matrix used for in incident management?
To decide which events get a full investigation, which are reviewed together and which go to leaders. The VA requires an individual RCA for sentinel events and events scored Actual 3 or Potential 3.
Sources
- DeRosier J, et al. Using Health Care Failure Mode and Effect Analysis: the VA National Center for Patient Safety's prospective risk analysis system. Jt Comm J Qual Improv, 2002
- VHA National Center for Patient Safety: Root cause analysis (page and Guide to Performing a Root Cause Analysis, rev. 02/05/2021)
- VHA National Center for Patient Safety: Proactive risk assessment (HFMEA, fault tree analysis, hierarchy of actions)
- CMS State Operations Manual, Chapter 7: Survey and Enforcement Process for Skilled Nursing Facilities and Nursing Facilities
Reviewed against the sources above on Oct 5, 2026. Rules change: confirm current requirements with the issuing body or your counsel before relying on any summary.
Put the definition to work.
IncidentKit turns these terms into workflow: reports, investigations, corrective actions and packets.