Is a risk matrix mandatory in Mexico?
The name is not. What is mandatory is the safety and health assessment and a program prioritized by risk (RFSST art. 7 sec. I and II; NOM-030 4.3, 4.4 and 5.2). The matrix is an orderly way to do both.
Risk Assessment Matrix for Plants in Mexico: NOM-030 Assessment and Program (Excel)
From the plant walkthrough
to the year's program.
NOM-030 requires a safety and health assessment and a program prioritized by risk, which the industry usually calls a risk matrix. This template organizes both: hazards by area, an editable 5 by 5 scale, controls from the top down and each action with dates and a responsible person.
Free: it only asks for your name and your work email.
| Hazard | P | S | Score | Level |
|---|---|---|---|---|
| Forklift in an aisle with pedestrians | 3 | 5 | 15 | Very high |
| Point of operation of the punch press | 3 | 4 | 12 | High |
| Cables across the walkway | 3 | 2 | 6 | Medium |
What the file includes
An Excel file with seven sheets for the assessment and the year's program.
Matrix
One row per hazard of each activity: source, harm, current controls, probability, severity, level, measure, responsible person, dates and residual risk, with automatic warnings.
Criteria
The 5 by 5 scale with its rationale, anchored in Mexico's Federal Labor Law and the NOM-023 severity table, and what to do at each level. Editable.
Program
The actions with the NOM-030 7.1 data, plus the health promotion and emergency rows.
NOM requirements and history
Which specific analysis each standard requires, how long it is kept, and the version log.
What Mexican standards require
- There is no form called a «matrix». Neither «risk matrix» nor «IPER» appears in the Federal Occupational Safety and Health Regulation or in the NOMs. What is mandatory is the safety and health assessment and a program based on it (art. 7 sec. I and II).
- The assessment, comprehensive or per area. NOM-030 requires identifying hazardous or unsafe conditions, physical, chemical and biological agents with their sources, surrounding hazards and the applicable legal requirements (4.3 and 6.1).
- The program, ordered by risk. Actions are prioritized «based on the risk involved» (5.2), each with dates and a responsible person (7.1), and the program is updated at least once a year (4.4). With fewer than 100 workers, a list of actions is enough (4.4.1).
- There is no general official scale. Each company defines its method. The official methods are specific (manual handling, NOM-036-1; confined spaces, NOM-033; chemical agents, NOM-010; fire, NOM-002), and the matrix records their result.
- Protective equipment comes last. NOM-017-STPS-2024 treats it as a temporary measure, complement or backup (5.2). The full hierarchy of controls comes from ISO 45001 and the ILO; no NOM lists it.
- Kept for two years. NOM-030 documentation is kept for at least two years, on paper or electronically (4.8 and 9.4), and the assessment is communicated to the safety and health committee or to the workers (4.5).
Sources: Federal Occupational Safety and Health Regulation (DOF 13-11-2014); NOM-030-STPS-2009, confirmed by the STPS in February 2025; NOM-017-STPS-2024, NOM-036-1-STPS-2018, NOM-023-STPS-2012 and NOM-019-STPS-2011 in the Official Gazette (DOF); Federal Labor Law. Checked on October 21, 2026.
How to use it in five steps
Define the scope
Comprehensive or per area, the number of workers and the safety and health lead.
Walk each area
With supervisors and workers: one row per hazard of each activity, with its source and today's controls.
Rate from 1 to 5
Probability and severity with the criteria sheet; the level fills in by itself and warns you of a serious and imminent risk.
Choose the measure
From the top down, from eliminating to PPE, and move it to the program with dates and a responsible person.
Communicate and review
To the committee and the workers; review the matrix with each change and when the program is updated each year.
Download the risk matrix (Excel)
It is a working guide: not an official form or legal advice, and each company is responsible for how it uses it.
The highest risks, practiced first
Fyware Safe has people practice four plant risks in virtual reality: fires and extinguishers, protective equipment, forklifts and pedestrian crossings, without exposing anyone.
Need help with the assessment?
SIISA Consultores (site in Spanish and English), serving all of Mexico, carries out compliance assessments, the NOM-030 safety program and support during STPS inspections. It is a Fyware partner.
Frequently asked questions about the risk matrix
Is there an official form or scale?
Not for general use. There are official methods for specific cases: manual handling (NOM-036-1), confined spaces (NOM-033), chemical agents (NOM-010), fire (NOM-002) and mines (NOM-023). The scale in this template is an editable proposal.
How often is it updated?
The program, at least once a year (NOM-030 4.4). The standard sets no period for the assessment: review the matrix when the program is updated, whenever a process, machine or substance changes, and after an accident, which is when several specific NOMs require updating their analysis.
More questions
How long is it kept?
At least two years, on paper or electronically (NOM-030 4.8 and 9.4). Some specific analyses have a different period: five years for the chemical agents study (NOM-010 8.4) and one year for heights, confined spaces and protective equipment.
How is it different from a JSA?
The matrix covers the areas and processes of the whole plant; a JSA goes down to one task and its steps. They complement each other: hazards a JSA finds in a task can move up to the matrix.
Can it be used to choose protective equipment?
Yes, if it includes the NOM-017-STPS-2024 5.1 data: position, activity, risks, body region, people who receive it and the name and signature of whoever did the analysis.
Let's talk about your plant
Tell us what you want to solve in your plant. Fyware designs extended reality around the equipment and constraints of your operation, and builds it to grow from a pilot to the whole site.
Tom Klukowski, Fyware Partner · Valcre Marketing We reply in under 24 business hours, with scope, timeline and investment range.In the meeting you see the simulator running and what it would take to bring it to your plant, with scenarios adapted to your layout. And if you need to sell it internally, this page is your presentation: share it with your team.