Does a Risk Score result of 99 mean that the machine is safe?
No.
Does it mean that the machine is dangerous?
Not always either.
And this is where the problem begins with one of the most commonly used methods for machinery risk assessment.
The Risk Score method is convenient. It can be shown easily in training. You can make a table. You can assign points. You can add or multiply values. You can set thresholds: low, medium, high risk. At the end, you get a number that looks very technical.
But what does that number really say?
If you do not know what it was derived from, not much.
Because a Risk Score result is not a measurement of risk. It is not a temperature that can be measured with a thermometer. It is not a mass that can be weighed. It is a record of how the assessment team understood a given hazardous situation: how severe the harm could be, how often a person is exposed, how likely the hazardous event is, and whether the person has a real possibility of avoiding injury.
And this is where the difference appears between a good method and a table that only looks good.
Many companies use the Risk Score method. Many companies provide risk assessment training using simple examples: choose a value from the table, calculate the result, check the color. The problem is that the most important part of this method is not in the formula itself.
The most important part is in the definitions of the parameters.
What does “frequent exposure” mean?
Once per shift? Once a day? Once a month? Only during maintenance? Or every time the operator clears a jam because the machine stops regularly?
What does “possibility of avoiding harm” mean?
That the operator can see the movement? That, in theory, they can pull their hand back? That they have time to react? Or only that someone decided: “they are trained, so they should be careful”?
What does a “probable hazardous event” mean?
Failure of a component? Human error? Bypassing a guard? Loss of control over the workpiece? Unexpected start-up? Rupture of a hose? The constant presence of a moving part near the operator’s hand?
Without answers to these questions, the number starts to mislead.
Not because the Risk Score method is bad.
Because someone is using it without understanding it.
ISO/TR 14121-2 describes numerical scoring as one of the methods that support risk estimation. Not as a magic formula for machine safety. The point is to assign values to classes of risk parameters and obtain a result that helps compare situations, set priorities, and show the effect of protective measures.
But that result only makes sense when it is clear what the points mean.
Because two people can look at the same machine and enter completely different values.
One will say: “the probability is low because there has never been an accident”.
The other will say: “the probability is high because the operator puts their hand near the crushing zone every day when clearing jams”.
One will say: “harm can be avoided because the movement is visible”.
The other will say: “harm cannot be avoided because the movement is fast, the distance is short, and the person’s reaction will be too late”.
Both people will use the same method.
Both may obtain a numerical result.
But only one of them may be right in the specific scenario.
That is why, in the Risk Score method, the most important question is not: “what result came out?”.
The most important question is:
why exactly did that result come out?
If the documentation can answer that, the number helps.
If it cannot, the number merely covers up a lack of reasoning.
Before you calculate the Risk Score, name the scenario
The worst way to use the Risk Score method?
Enter the hazard and start calculating immediately.
“Hazard: moving parts”.
S = 3.
F = 4.
O = 3.
A = 5.
Result: 15 or 180 or 60 — depending on the method.
But that is not yet risk assessment.
That is guessing in a table.
ISO 12100 requires an earlier step. First, you have to understand what you are actually assessing. The hazard alone is not enough.
A moving blade is a hazard.
But risk does not exist because the blade is part of the machine.
Risk appears when a person can be in a situation where that hazard can cause harm.
That is why you need to ask a few simple questions.
Who is exposed?
The operator? A maintenance technician? A cleaner? A service technician? A worker who is only passing by?
When are they exposed?
During normal operation? During cleaning? During setting? When clearing a jam? During tests after adjustment? With the guard open? With the machine stopped, but with energy stored in the system?
What can happen?
Unexpected start-up? Loss of control over the workpiece? Sleeve entanglement? Hose rupture? Ejection of a component? Dropping of a heavy part? Entry into the hazard zone before the movement has stopped?
What harm could occur?
A cut? A fracture? Crushed fingers? Amputation? Death? Hearing loss after years of work? Respiratory disease caused by dust?
Only then can you move on to the assessment in a meaningful way.
Because the Risk Score method should not assess “moving parts” as a general label.
It should assess a specific scenario.
For example:
the operator clears a jam in the infeed zone with the guard partially open, and hazardous movement may occur after restart;
a maintenance technician adjusts a sensor near a drive, and the actuator may make a sudden movement after pressure is restored;
the operator manually feeds a workpiece into the tool zone, and the workpiece may be pulled out and drag the hand toward the rotating part.
These are scenarios.
And only for them does the Risk Score result start to have meaning.
The same machine can have several completely different results for the same source of hazard.
Why?
Because the task being performed is different.
A different person is exposed.
The frequency of exposure is different.
The possibility of avoiding harm is different.
The state of the machine is different.
The protective measures applied are different.
Let’s take a simple example.
A moving element is located behind a fixed guard.
During normal operation, the operator has no access to it. Exposure is low or practically nonexistent.
But during maintenance, the guard is removed. The worker has their hands near the drive. Sometimes they have to rotate the mechanism manually. Sometimes someone may restore the power supply. Sometimes energy remains in the system.
Is this still the same Risk Score?
It should not be.
The hazard may be the same, but the hazardous situation is now different.
And that is precisely why the scoring method is useful only when we keep the correct order.
First, the scenario.
Then, the parameters.
Finally, the result.
Not the other way around.
Does ISO 12100 say how to calculate the Risk Score?
No.
And this is very important.
ISO 12100 does not say: add the parameters.
It does not say: multiply the parameters.
It does not say: use a scale from 1 to 5.
It does not say: mark a score above 100 in red.
ISO 12100 says something more important: risk depends on the severity of harm and the probability of occurrence of that harm.
And probability is not one simple value adopted arbitrarily.
It may depend on how often a person is exposed to the hazard, whether a hazardous event may occur, and whether the person has the technical and practical possibility of avoiding or limiting harm.
That is why, in practice, different versions of the Risk Score method are used.
One company uses two parameters:
severity of harm × probability.
Another uses three:
severity × exposure × probability.
Yet another breaks probability down into several elements:
severity, frequency of exposure, possibility of occurrence of a hazardous event, possibility of avoiding harm.
Someone else adds further parameters.
Someone multiplies.
Someone applies thresholds.
Someone uses a matrix after determining the risk class.
Does this automatically mean non-compliance with ISO 12100?
No.
Provided that the method still assesses what it should.
That is, the severity of possible harm and the probability of its occurrence.
If you break probability down into frequency of exposure, possibility of occurrence of a hazardous event and possibility of avoiding harm — it makes sense.
If you have clear definitions of the parameters — it makes sense.
If you use the same principles before and after risk reduction — it makes sense.
If you can show what the applied protective measure actually changed — it makes sense.
But if you add random parameters to the method because “that was how it was in Excel”, a problem appears.
If in one case frequency means the number of entries into the zone per week, and in another case the assessor’s general impression, a problem appears.
If the possibility of avoiding harm depends on whether someone believes in the operator’s reflexes, a problem appears.
If, after applying a guard, someone lowers the severity of harm even though contact with the same tool would still cause an equally severe injury, a problem also appears.
Because the Risk Score method is not sound simply because it has four columns.
It is not sound simply because it has a formula.
It is not sound simply because it gives a color-coded result.
It is sound when it helps answer honestly the question:
what actually changed in the risk?
Have we reduced the severity of possible harm?
Have we limited human exposure?
Have we reduced the probability of occurrence of a hazardous event?
Have we improved the possibility of avoiding harm?
Or have we only changed the numbers so that the result looks better?
This is the difference between a method and the appearance of one.
Numerical scoring in ISO/TR 14121-2 — an example of a method, not a magic formula
Since ISO 12100 does not say exactly how to calculate the Risk Score, where does the scoring method come from at all?
From practice.
And from supporting documents that show examples of tools for risk estimation.
ISO/TR 14121-2 describes several such tools: risk matrix, risk graph, numerical scoring and hybrid methods. This is an important distinction. ISO 12100 sets out the risk assessment process. ISO/TR 14121-2 shows examples of how this process can be carried out in practice.
So numerical scoring is not the only correct method.
Nor is it a mandatory calculator from the standard.
It is an example of an approach in which numerical values are assigned to risk classes and then combined into a result.
In the simplest version, there can be two parameters:
severity of harm,
probability of occurrence of harm.
You assign a value to one for severity. You assign a value to the other for probability. Then you combine these values and obtain the Risk Score result.
Sounds simple?
Yes.
And that is precisely why this method is so popular.
In training, it looks great. In Excel, it works immediately. In a table, it brings order. In a report, it looks technical.
But numerical scoring is not good because it gives a number.
It is good when the number leads back to the assumptions.
Let us take an example.
If the possible harm is very severe and the probability of its occurrence is also high, the result will be high. That is not surprising.
But now the more important question:
why was the harm considered very severe?
why was the probability considered high?
is this about daily operator access?
is it about frequent clearing of jams?
is it about the possibility of bypassing the guard?
or is it because the event may occur suddenly and the person will not have time to react?
Without this, the result looks like an analysis, but carries no substance.
In examples of numerical scoring, you may encounter a result such as 175 points and classification as high risk.
Does 175 mean that someone measured risk to an accuracy of one point?
No.
It means that, with the adopted scale, adopted thresholds and adopted values, the given situation fell into the high-risk class.
And that is an honest approach.
The problem begins when someone treats the score of 175 as if it were a laboratory measurement.
Or even worse: when they compare a score of 99 from one company with a score of 99 from another company, although both companies have different scales, different thresholds and different definitions of parameters.
Then the number stops bringing order.
It starts pretending to be a common language that in reality does not exist.
That is why, in the Risk Score method, three things must be separated from the start.
First: the formula.
Do we add? Do we multiply? Do we combine the parameters in another way?
Second point: the scale.
Does severity have values from 1 to 4? Or from 1 to 5? Does catastrophic harm have 100 points? Does frequency carry more weight than the possibility of avoidance?
Third point: definitions.
And this third point is the most important.
Because a formula can be rewritten in five minutes.
A scale can be pasted from a ready-made template.
But definitions have to be understood.
What does “frequent exposure” mean?
What does “probable event” mean?
What does “possible avoidance of harm” mean?
What does “severe harm” mean?
If the definitions are weak, the Risk Score method will be weak, even if the formula looks professional.
And vice versa.
If the definitions are good, the team can work sensibly even with a simple points-based method.
Because then the discussion does not sound like this:
“It came out as 99, so it is medium.”
But rather:
“It came out as 99 because the harm is severe, exposure occurs at every tool change, the event may occur if pressure is lost, and the possibility of avoiding harm is low. After applying a mechanical lock and an energy dissipation procedure, we reduced the probability of the event, but we did not change the severity of the possible harm.”
That is a completely different quality of documentation.
The same number then begins to have meaning.
Not because it is precise.
Because it can be defended.
Parameters in the Risk Score method — this is where the error most often begins
In practice, the Risk Score method very often comes down to a few abbreviations.
S.
F.
O.
A.
Or:
S.
E.
P.
A.
Or something else again, depending on the company, training, Excel sheet, or software.
And that in itself is not a problem.
The problem begins when no one on the team can say exactly what a given parameter means.
Because if S means “severity of harm,” then it must be established which harm we are assessing.
The most probable?
The most severe possible?
The most severe that can be reasonably foreseen in this scenario?
If F means frequency of exposure, then it must be established whether we are looking at normal operation, maintenance, cleaning, setting, clearing jams, or all situations in which a person can realistically be in the hazard zone.
If O means the possibility of occurrence of a hazardous event, then it must be established whether we are talking about a technical failure, human error, bypassing a guard, loss of control of the workpiece, unexpected start-up, or another event.
If A means the possibility of avoiding harm, then we must stop pretending that “the operator is careful” is a protective measure.
| Parameter | What it should describe | Typical error in practice | Question worth asking |
|---|---|---|---|
| S — severity of harm | How severe the harm may be in a specific scenario. | Reducing severity after applying a guard, even though contact with the same tool would still cause an equally severe injury. | What will realistically happen to a person if contact, crushing, entanglement, ejection, or electric shock occurs? |
| F / E — frequency or exposure | How often and for how long a person is in a hazardous situation. | Counting only normal operation and omitting cleaning, setting, maintenance, or clearing jams. | When is a person really in the hazard zone, and how often do they have to be there? |
| O / Pr — possibility of occurrence of a hazardous event | Whether and how an event that initiates the harm scenario may occur. | Assigning a low value only because “there has not been an accident yet.” | What can go wrong: technically, organizationally, or through foreseeable human behavior? |
| A / Av — possibility of avoiding or limiting harm | Whether a person has a real possibility of avoiding injury once the situation has started. | Assuming that a trained operator will always react in time. | Does the person see the hazard, understand it, and have the time, space, and real possibility to react? |
This table is more important than the formula itself.
Because the formula only processes values.
And the values result from human decisions.
If the parameter definitions are weak, the Risk Score result will be weak, even if the sheet looks professional.
If the definitions are good, even a simple points-based method can lead to a sensible discussion about risk.
Then the team is not discussing whether to “give it 3 or 4 so that the result looks better.”
The team is discussing the scenario:
is the operator really exposed every day?
can the event occur suddenly?
does the guard restrict access, or does it merely shift the problem to the cleaning stage?
after applying the protective measure, did the exposure, probability of the event, possibility of avoiding harm change, or only the color in the table?
And only then does the Risk Score method begin to do what it is supposed to do.
It does not replace thinking.
It organizes it.
Can different versions of Risk Score be correct?
Yes.
Provided that they do not lose the meaning of risk assessment.
ISO 12100 does not impose a single formula. It does not say that you have to add. It does not say that you have to multiply. It does not say that the scale must have four or five levels.
It requires the risk assessment to take into account the severity of possible harm and the probability of its occurrence.
That is why, in practice, different versions of the Risk Score method and numerical scoring can be encountered.
| Method variant | Example logic | What works well | What to watch out for |
|---|---|---|---|
| S × P | Severity of harm × probability of harm | A simple method, easy to understand and implement. | Probability can be too general. The team lumps exposure, failures, human errors and the possibility of avoiding harm into one category. |
| S × F × P | Severity × frequency of exposure × probability of the event | It shows more clearly that risk increases when a person is often in the hazard zone. | There may still be no separate assessment of whether a person has a real possibility of avoiding harm. |
| S + F + O + A | Sum of severity, frequency, event and possibility of avoidance | A clear method, good for comparing scenarios and tracking changes after risk reduction. | Addition can flatten differences. Very severe harm may be “diluted” by lower values of the other parameters if the thresholds are set incorrectly. |
| S × (F + O + A) | Severity separately, probability broken down into several elements | It shows well that the severity of harm is different in nature from the elements of probability. | It requires very clear parameter definitions so that the result does not become random mathematics. |
| Hybrid method | First points for the parameters, then the risk class from a matrix | It can be convenient when a company wants to combine numbers with a simple risk classification. | It is easy to turn it into a coloring exercise if no one describes the scenario and the justification for the values. |
The fact that a method has a different formula does not yet mean that it is wrong.
It becomes wrong when it is not clear what the parameters mean.
It becomes wrong when the final result replaces the scenario description.
It becomes wrong when the team changes the numbers after applying a protective measure, but cannot say which element of the risk has actually changed.
Because the Risk Score method is not about every company calculating in exactly the same way.
It is about every company calculating with awareness.
Why is the Risk Score result alone not enough?
In practice, the Risk Score method very often ends with one word.
Low.
Medium.
High.
Or with one number.
But the number alone does not yet tell us what problem we are facing.
In SafetySoftware, the Risk Score method shows not only the final result, but also its components. The user selects values for several parameters, and the system shows what the risk indicator was built from.
For example:
S = 2 — serious but reversible harm
F = 3 — exposure occurs sometimes
O = 3 — a hazardous event is possible
A = 3 — avoiding harm is possible
Result:
2 + 3 + 3 + 3 = 11
Category:
medium risk
And that is fine.
But the most important thing is not the “11” itself.
The most important thing is that it is clear where that 11 came from.
Because let us imagine three different assessments:
| Result components | Result | What this may mean in practice |
|---|---|---|
| 2 + 3 + 3 + 3 | 11 | The harm is serious, exposure occurs sometimes, the event is possible, and the person may have some possibility to respond. |
| 4 + 1 + 1 + 5 | 11 | The harm may be fatal, but exposure is very rare, the event is almost impossible, and if it does occur — the person will not avoid harm. |
| 1 + 5 + 4 + 1 | 11 | The harm is minor, but exposure is continuous, the event is probable, and avoiding harm is almost certain. |
Mathematically, the result is the same.
Technically, these are three different discussions.
In the first case, one can ask whether the protective measure should limit exposure or reduce the possibility of the event occurring.
In the second case, the severity of harm must not be ignored just because the sum came out the same. If the possible harm is fatal, it is necessary to check very carefully whether the low values of the other parameters are truly justified.
In the third case, the problem may not be the severity of harm, but the fact that the person is constantly exposed to minor but repeated injuries or discomfort.
There are also more problematic cases.
Imagine an assessment:
4 + 1 + 1 + 1 = 7
In many tables, this will already be a low category.
At first glance, everything looks good.
Exposure is rare.
The event is unlikely.
Avoiding harm is possible.
The issue is that the parameter S = 4 means death or catastrophic consequences.
And here a very practical question arises:
are we really ready to accept the risk only because the sum came out low?
If someone claims that the risk of a fatal accident is “low”, they should be able to justify very well why the other parameters received such favorable values.
Is the exposure actually sporadic?
Is the event actually so unlikely?
Does the person really have a possibility of avoiding the consequences?
Such cases show that the final category alone may lull people into complacency.
On the other hand, there are situations in which the direction of action is almost obvious.
For example:
2 + 5 + 4 + 3 = 14
Here, the biggest problem is not the severity of harm.
The biggest problem is that the person is exposed very often, and the hazardous event is relatively probable.
If the operator has to put a hand into the hazard zone several times per shift, the solution often suggests itself:
eliminate the need to enter this zone.
Add an automatic feeder.
Move the adjustment point outside the hazardous area.
Use an interlocking guard.
In such a case, there is no need for a long discussion about the mathematics.
It is immediately clear which parameter should be improved and which protective measure may deliver the greatest effect.
And that is exactly why, in the Risk Score method, it is not enough to show the final category.
“Medium” is not enough.
“Low” is often not enough either.
The breakdown of the score must be shown.
Because only then is it clear which element of the risk truly requires action.
Is the problem the severity of the possible harm?
Or excessive exposure of a person?
Or a high probability of a hazardous event?
Or the lack of a real possibility of avoiding harm?
The same applies to the assessment after applying a protective measure.
If the score has fallen from 15 to 9, the question is not: “has it turned green?”.
The question is:
what has changed?
Has the guard restricted access to the hazard zone?
Has the interlock reduced the probability of hazardous movement with the guard open?
Has the reduced speed improved the possibility of avoiding harm?
Has the design change actually reduced the severity of the possible injury?
Or has someone simply lowered the values so that the score looks better?
That is why a good Risk Score should not hide behind the final result.
It should show the distribution of the parameters.
Then the number starts to be useful.
Not as proof of safety.
As a trace of a decision.
Risk Score in SafetySoftware — the number must have justification
In Excel, you can calculate anything.
You can create S, F, O, A columns.
You can enter values.
You can add a formula.
You can set colors.
You can even create a table that looks very professional.
But the problem with risk assessment is rarely that someone cannot add four numbers.
The problem is whether, after a month, a year, or after an accident, someone will be able to answer a simple question:
why were these particular values entered?
Why was the severity of harm assessed as 2 and not 4?
Why was exposure considered “sometimes” when the operator clears jams several times per shift?
Why was the possibility of avoiding harm assessed as possible when the movement appears suddenly?
Why, after applying a guard, was the severity of harm reduced rather than the frequency of exposure?
And this is exactly where the Risk Score method needs order.
In SafetySoftware, the Risk Score result should not be a standalone number.
It should be linked to the entire scenario:
what hazard we are dealing with,
in which area of the machine,
during which task,
who is exposed,
what hazardous event may occur,
what harm may arise,
what parameter values were adopted,
what result was obtained,
what protective measure was applied,
what result was obtained after risk reduction,
what residual risk still remains.
Only then does the number start to work.
Not as decoration in a report.
Not as a color in a table.
Not as an argument that “it came out medium, so it is fine”.
But as part of a technical decision.
This is especially important when assessing risk after applying protective measures.
If a fixed guard has been added, the severity of the possible harm usually does not change. Contact with a cutting element can still cause a serious injury.
Exposure changes.
Because a person no longer has free access to the hazard zone during normal operation.
If an interlocking guard has been added, the probability of a hazardous event may change.
Because opening the guard should stop the hazardous movement.
If speed has been limited in setting mode, the possibility of avoiding harm may change.
Because a person has more time to react.
If the design has been changed and the crush point has been removed, the severity itself may change, or the entire hazard may be eliminated.
And this is exactly the difference between a good risk assessment and copying points.
In a good risk assessment, we do not reduce the score because “a safeguard was added”.
We show which element of the risk has actually changed.
SafetySoftware is intended to help with this.
Not because the software will make the decision for the designer.
Not because it will declare the machine safe on its own.
But because it structures work that cannot be skipped anyway.
Method.
Parameters.
Definitions.
Result before reduction.
Protective measures.
Result after reduction.
Residual risk.
Justification.
This is the real value of the Risk Score method.
Not the number itself.
But the ability to show where that number came from and what changed after the design decision.
When does the Risk Score method help, and when does it deceive?
The Risk Score method helps when it forces the team to structure its thinking.
It helps when many hazardous situations need to be compared.
It helps when priorities need to be set.
It helps when the difference between the state before risk reduction and after applying protective measures needs to be shown.
It helps when it shows that the problem is not always the severity of harm itself.
Sometimes the problem is excessive exposure.
Sometimes it is the possibility of bypassing the guard.
Sometimes it is the lack of time to react.
Sometimes it is that the operator has to perform a task in a place where they should not be at all.
But the Risk Score method deceives when it starts to replace thinking.
It deceives when someone enters values without describing the scenario.
It deceives when the team does not understand the parameters.
It deceives when the final result is treated as proof of safety.
It deceives when, after applying a protective measure, someone lowers the values only so that the score looks better.
It deceives when a low sum conceals very severe possible harm.
It deceives when the “possibility of avoiding” is based on faith in the operator’s reflexes.
It deceives when “low probability” results only from the fact that there has been no accident so far.
And that is exactly why the Risk Score method requires discipline.
Not advanced mathematics.
Discipline.
First, the scenario must be named.
Then the parameters must be established.
Then the same logic must be applied before and after risk reduction.
Then it must be checked whether the applied protective measure has actually changed the risk, or only improved the appearance of the table.
Finally, documentation must be left that can be understood without the person who prepared it being present.
Because a good risk assessment is not prepared only for the day the report is signed.
It is also prepared for the day when someone asks:
why did you consider that this risk had been adequately reduced?
Summary: the number is not the goal
The Risk Score method is popular because it is simple.
And that is its advantage.
But that same simplicity can be a trap.
Because it is easy to confuse calculation with risk assessment.
It is easy to confuse color with a decision.
It is easy to confuse a result with evidence.
And ISO 12100 is not about making the table look good.
It is about the manufacturer being able to demonstrate that it identified the hazards, estimated the risk, selected protective measures, verified the effect of the risk reduction, and described the residual risk.
Risk Score can help a great deal with this.
Provided that it does not start to take on a life of its own.
A score of 11, 14, or 99 does not yet say whether the machine is safe.
It only says that specific values were adopted.
Only when it is known where they came from does the number gain meaning.
That is why the most important question in the Risk Score method is not:
what score came out?
The most important question is:
can you defend the values that led to that score?
If yes, the method helps.
If not, the method only creates the appearance of order.