Risk Matrix for High-Hazard Facilities: When Is It Not Enough?
A risk matrix helps teams screen and prioritise hazards. It cannot demonstrate off-site risk, consequence contours or the adequacy of major-incident barriers at a high-hazard facility.
Risk Matrix for High-Hazard Facilities: When Is It Not Enough?
A risk matrix helps teams screen and prioritise hazards. It cannot demonstrate off-site risk, consequence contours, or the adequacy of major-incident barriers at a high-hazard facility.
MMRisk helps duty holders turn matrix findings into HAZOP, LOPA, QRA and evidence that can support a safety case, emergency plan and management decision.
A matrix answers a limited question
Most teams know the format: a consequence score on one axis, a likelihood score on the other, and a colour that signals the action required. It can work well for routine task risks, maintenance planning and an early site screen. It gives a team a shared way to decide which issues need attention first.
The method reaches its limit when the scenario involves a major accident hazard. A red box does not show how far a toxic plume could travel, whether a vapour cloud could reach a neighbouring business, or whether the firewater system will still deliver its required flow after a power loss. Those questions need a defined scenario, credible data and a method that can test the barriers.
Treat the matrix as the front door to the assessment. Do not use it as a substitute for the work that follows.
Four signs you need to go beyond the matrix
Escalate the assessment when one or more of these conditions applies:
- The event could affect people beyond the unit or site boundary. LPG, flammable liquids, ammonia, chlorine, hydrogen, high-pressure gases and large fuel inventories can create consequences that do not stop at a fence.
- The risk depends on a sequence of failures. A matrix cannot test the combined effect of a leak, delayed isolation, ignition, failed detection and an unavailable firewater pump.
- A decision needs a defensible technical basis. A licence application, safety report, land-use decision, major modification or insurer review needs traceable assumptions and evidence.
- The existing safeguards carry the risk claim. If the site depends on a trip, relief system, deluge valve, emergency shutdown, operator response or municipal support, the assessment must state what that protection has to do and how the site proves it.
The 2022 MHI Regulations require high-hazard establishments to manage major-incident risk through formal prevention, safety-report and operating-licence processes. The Department of Employment and Labour confirmed that the phase covering Major Incident Prevention Policies and Safety Cases has applied since 1 February 2026. A colour-coded register will not meet that evidence burden on its own.
Use the right method for the decision
The next step depends on the gap the matrix has exposed.
| If the team needs to know | Use |
|---|---|
| What can deviate from design intent and why | HAZOP |
| Which initiating events deserve more detail | HAZID or a structured scenario screen |
| Whether independent safeguards reduce the risk sufficiently | LOPA |
| How a release, fire, explosion or toxic plume could affect people and property | Consequence modelling |
| The frequency and geographic extent of risk | QRA |
| These methods work as a chain. A HAZOP gives the team credible deviations and causes. LOPA tests whether the proposed safeguards carry enough independence and reliability. Consequence modelling translates a loss of containment into thermal radiation, overpressure or toxic endpoints. QRA combines credible frequencies and consequences where a decision needs numerical risk contours. |
Build a bridge from the register to the evidence file
Start with the current risk register, but do not stop there. For each major-hazard entry, record the material, inventory, operating conditions, nearby receptors and the event that could release energy or toxic material. Identify the prevention and mitigation barriers. Give each barrier a clear owner and an assurance task.
For example, a tank overfill scenario may rely on a level indication, a high-high trip, an operator response, a remote isolation valve, bund capacity and firewater availability. The assessment needs more than the statement that those controls exist. It needs their set points, response times, test records, impairment controls and the conditions under which the scenario stays tolerable.
This is where the register becomes a useful management tool. It tells operations what must work today, maintenance what needs proof testing, and leaders what evidence must be closed before they accept a residual risk.
Do not hide uncertainty inside a likelihood score
Teams often give a scenario a low likelihood because no similar event has happened recently. That judgement can mask missing information. A low-frequency event can still drive a high consequence, particularly where a release could reach workers, neighbours, roads, public infrastructure or an adjacent installation.
State uncertainty plainly. Confirm the inventory. Check the site layout. Validate the failure data and the barrier assumptions. Review the land uses around the facility and any planned changes. A risk contour has value because it makes the question visible to the people who must make the decision.
Turn assessment findings into work that closes
An assessment delivers value when it changes the site. Each recommendation should identify the risk it addresses, the barrier affected, the accountable owner, the due date and the evidence needed for closeout. Link design changes through management of change. Link equipment actions to the safety-critical equipment register. Link emergency actions to drills, observations and action tracking.
That discipline matters now. Recent practitioner discussion around overdue inspection items and improvised maintenance fixes reinforces the same point: equipment labels and completed forms do not prove that a barrier will work under demand. A site needs current, scenario-linked evidence.
MMRisk can help your team screen whether a matrix is enough, facilitate HAZOP and LOPA workshops, model credible consequences, perform QRA and organise the evidence for an MHI safety case. Contact MMRisk to discuss your facility, proposed change or compliance deadline.
Frequently asked questions
Does a risk matrix meet MHI requirements in South Africa?
No. A risk matrix can support screening and prioritisation, but high-hazard compliance may require a formal risk assessment, prevention policy, safety report, consequence modelling or QRA. The method should match the material, inventory, potential consequences and regulatory decision.
When should a team use QRA instead of a risk matrix?
Use QRA when a decision requires numerical frequency and consequence estimates, especially where a credible incident could affect people or property beyond the immediate work area. A matrix can identify the need for QRA, but it cannot produce risk contours or societal-risk results.
Does a HAZOP replace QRA?
No. A HAZOP identifies deviations, causes and safeguards. QRA quantifies selected major-incident scenarios. The two methods often support the same assessment path.