Risk & Worksite Analysis
Scoring & Ranking Workplace Violence Risks
How to score and rank healthcare workplace violence hazards with a likelihood-severity matrix and build a defensible, survey-ready risk register surveyors and litigators accept.
Scoring a workplace violence hazard means rating it on two axes — how likely a violent event is in that area or scenario, and how severe the outcome would be if one occurred — then combining the two into a single, comparable risk rating. Ranking turns a flat list of findings into a prioritized queue. The register that holds those scores is the document a surveyor opens to ask the only question that matters: did you act on the worst risks first?
A worksite analysis that identifies twenty hazards but ranks none of them invites the most damaging survey finding of all — that you recognized a hazard and did nothing measurable about it. This guide covers how to score, how to rank, and how to build the register that makes your prioritization defensible.
#Why scoring is a compliance requirement, not a formality
No single regime dictates a scoring formula, but three converge on the need to prioritize:
- The Joint Commission workplace violence prevention requirements (effective Jan. 1, 2022 for hospitals) call for an annual worksite analysis with follow-up in the Environment of Care chapter. Follow-up that is not prioritized is just a to-do list with no logic.
- OSHA Publication 3148, Guidelines for Preventing Workplace Violence for Healthcare and Social Service Workers, frames hazard prevention and control as a tiered response — you address the most serious recognized hazards first, and the General Duty Clause §5(a)(1) makes a recognized hazard citable when you knew and failed to abate.
- Texas HSC Chapter 331 (added by SB 240) requires a facility-specific plan and an annual evaluation to the governing body — and a governing body cannot evaluate a plan without seeing which risks ranked highest and what was done about them.
A scored, ranked register answers the deposition question in one page: "Here is everything we found, here is how we rated it, here is what we did, in what order, and why."
#The two axes: likelihood and severity
Score every identified hazard on the same two dimensions, using a written scale so the rating is reproducible by anyone on your committee.
Likelihood — how probable is a violent event in this area, scenario, or population? Anchor it in your own data, not impression. A unit with rising incident counts, a high-volume behavioral-health boarding location, or a lone-worker scenario scores higher than a low-traffic administrative space.
Severity — if an event occurred here, how bad would the outcome be for staff? Consider the patient population (acuity, intoxication, agitation history), the presence of weapons of opportunity, staff isolation, and how quickly help could arrive.
A simple, defensible scale uses 1–5 on each axis:
| Score | Likelihood | Severity |
|---|---|---|
| 1 | Rare — no recent events, low-risk population | Minor — verbal, no injury potential |
| 2 | Unlikely | Limited — minor physical contact possible |
| 3 | Possible — occasional events or rising trend | Moderate — injury requiring first aid |
| 4 | Likely — recurring events in this area | Serious — injury requiring medical treatment |
| 5 | Almost certain — frequent or escalating | Severe — risk of major injury |
#Combining the axes into a single rating
Multiply (or matrix-map) the two scores. A 5×5 matrix yields a risk score from 1 to 25 and sorts naturally into priority bands:
| Combined score | Priority band | What it signals |
|---|---|---|
| 15–25 | Critical | Address now; document interim controls immediately |
| 8–14 | High | Schedule near-term abatement with a named owner |
| 4–7 | Moderate | Plan and monitor; revisit at next cycle |
| 1–3 | Low | Document; accept or monitor with rationale |
The exact thresholds matter less than using them consistently every cycle. A surveyor is not grading your math — they are checking that the same logic produced the ranking each time, so that a high-risk ED finding never sits below a low-risk supply-closet note.
#Building the risk register
The register is where scoring becomes a managed program. Each row carries the finding from identification through closure. Minimum columns:
| Column | Purpose |
|---|---|
| Finding ID & date | Traceability back to the worksite analysis |
| Location / scenario | Where the hazard lives |
| Hazard description | What was observed — specific, not generic |
| Likelihood (1–5) | Scored against the written scale |
| Severity (1–5) | Scored against the written scale |
| Combined score & band | The ranking that drives sequencing |
| Control(s) selected | Engineering, administrative, or training response |
| Owner & target date | Accountability and timeline |
| Status & closure date | Open, in progress, closed, or carried forward |
This register is the connective tissue between your analysis and your action plan. The findings flow in from your hazard identification — see using your own incident data to drive a defensible worksite analysis — and flow out into your sequenced response, covered in translating worksite-analysis findings into a prioritized corrective action plan.
#Common scoring mistakes surveyors catch
- Scoring impression, not data. A likelihood rating with no incident history or frontline input behind it reads as a guess. Anchor scores in evidence.
- No interim controls on a Critical item. If a hazard scores 20 and the permanent fix is a six-month capital project, the register must show what you did in the meantime. A high score with a long timeline and no interim control is the classic "recognized but not abated" exposure.
- Letting items sit without rescoring. Risk is not static. Each annual cycle, rescore open items — a hazard that trended up should climb the ranking, and the register should show it.
- Closing items without verification. "Closed" must mean the control was implemented and confirmed effective, not that someone marked a box.
#A note on scope
Scoring and ranking workplace violence risks is a compliance and documentation activity — it identifies, rates, and sequences gaps and proves the facility prioritized rationally. It is not a guard deployment, patrol design, or physical-security staffing service. The deliverable is a dated, defensible risk register and a sequenced corrective-action queue — not personnel on a post.
#How VIGILO helps
VIGILO builds and maintains the scored risk register as the core deliverable of a workplace violence risk assessment: applying a consistent likelihood-severity method to every finding, ranking them into defensible priority bands, and tying each to a named owner and closure date through an annual program review. For Texas facilities the register feeds directly into the HSC Chapter 331 requirements and the governing-body evaluation. To see where your current ranking stands, start with the Chapter 331 compliance checklist.
VIGILO provides compliance, training, and consulting assistance and supports survey-readiness and preparedness; it does not guarantee safety outcomes and does not provide security guard, patrol, or investigative services. Sources: The Joint Commission Workplace Violence Prevention requirements (Environment of Care chapter, annual worksite analysis with follow-up; effective Jan. 1, 2022 for hospitals); OSHA Publication 3148 (Hazard Prevention & Control) and General Duty Clause §5(a)(1); Texas Health & Safety Code Chapter 331 (SB 240, 88th Leg., 2023) and 26 TAC §133.55.