The RAC Matrix Explained: How to Assign a Risk Assessment Code on Your AHA
It is 6:30 in the morning, the excavator is warming up, and the foreman hands you the trench AHA to sign. You flip to the last column and every single row says M. The hazards are right, the controls are solid, but somebody guessed at the letters, and if a reviewer catches it, that trench does not open today. I have seen that exact scene more times than I can count while reviewing safety submittals on federal jobs.
The fix is not complicated. The Risk Assessment Code is just your honest answer to one question: after my crew does everything in the controls column, how much risk is left? In the next few minutes I will show you, with a picture for every step, how to read the matrix in the 15 March 2024 edition of EM 385-1-1, how to pick severity and probability in the field, how to set the overall code on your activity hazard analysis, and who has to sign off once the letters are on the page.
What a Risk Assessment Code Actually Means
EM 385-1-1 defines the Risk Assessment Code as the conversion of the probability and severity of a hazard into a risk level based on the residual risk, and it gives you four levels: extremely high (E), high (H), medium (M), and low (L) (EM 385-1-1, 2-2.u). Residual risk is what remains after controls are selected (2-2.t), and the manual requires a RAC on each job step that identifies the residual risk remaining after controls have been applied (2-6.d(4)(e)), so you are never rating the raw hazard on a contractor AHA. As Figure 1 shows, the same trench hazard can rate E before controls and H after them, and the H is what belongs on the form.
The Two Inputs: Severity and Probability
The risk matrix weighs two things for each hazard. Severity is the approximate amount of harm, damage, or injury that could occur, and probability is the likelihood of it happening (2-2.w).
Severity levels
The manual lists four severity categories: catastrophic, critical, moderate, and negligible (2-2.w). Figure 2 lays them out from worst to least, using the descriptions printed on ENG Form 6206. Older copies of the form call the third row "marginal," and it means the same thing as moderate.
Probability levels
Probability runs across five columns: frequent, likely, occasional, seldom, and unlikely (2-2.w). In plain terms, I ask the foreman how often he has actually watched this go wrong on jobs like this one, with these controls in place. Figure 3 puts the five levels on a single scale from most likely to least likely.
Reading the Matrix
Find the severity row, slide over to the probability column, and the letter where they meet is your RAC. Figure 4 is the matrix printed on the current ENG Form 6206, with arrows showing exactly where to look: the severity row on the left, the probability column across the top, and the cell where they cross.
How I Assign a RAC, Step by Step
- Write the controls first. You cannot rate residual risk until the controls are on paper. Work down the hierarchy of controls in 2-6.b, from elimination and engineering controls to administrative controls and then PPE.
- Pick the worst realistic severity. Controls almost always lower the probability, not the severity. A trench wall that lets go can still kill someone even when the walls are sloped, so that hazard stays catastrophic.
- Pick the probability with the controls in place. A trench sloped to the soil type, with a competent person inspecting it every shift, moves a cave-in from likely down to seldom.
- Read the letter off the matrix. Catastrophic and seldom gives you H, and Figure 5 traces that path across the row and down the column.
- Add controls if the letter is still too high. When one layer of control is not enough, the manual says to add more until the risk is acceptable, which it describes as low or medium where possible (2-6.d(4)(d)).
- Set the overall RAC. The overall RAC must not be lower than the highest job step RAC on the AHA (2-6.d(4)(f)). One H row makes the whole AHA at least H. You never average it down.
Figure 6 shows where those letters end up on the AHA itself: one residual RAC per job step, and an overall RAC at the top that matches the highest step.
Three Field Examples
Here are three jobs I see all the time. Figure 7 drops each one onto the matrix so you can see where they land.
Trenching for a utility run
The hazard is a cave-in. Severity is catastrophic. With soil classification, sloping, egress within 25 feet of lateral travel, and shift inspections by the competent person, I rate probability as seldom, which gives H. That row sets the whole excavation AHA at High. Under EM 385-1-1 the excavation AHA must also be developed by a competent person and show egress methods and locations and the CP's identification and credentials (25-6).
Placing a slab
On a concrete placement AHA, the pump boom and hose whip can seriously injure the finisher at the end of the hose. With a designated hose handler, a clear zone, and a pump operator who has eyes on the crew, I usually land on critical and seldom, which gives M. Skin burns from wet concrete fall into moderate and seldom, which gives L.
Setting steel
On a steel erection AHA, a fall from the connecting level is catastrophic. This is one place where the two rule books differ, so write to the right one. EM 385-1-1 sets a 6 foot fall protection threshold that expressly includes steel erection (21-8.a(1)), while OSHA generally sets 15 feet for steel erection and lets connectors work up to two stories or 30 feet, whichever is less, under specific conditions (29 CFR 1926.760(a)(1) and (b)). On a Corps job I write to 6 feet. With fall protection at that threshold, a rescue plan, and trained connectors, probability is seldom and the step is H. An honest H gets through review faster than a hopeful M.
Why the Letter Matters Beyond the Form
The RAC drives three things that affect your schedule, and Figure 8 walks through the first one, acceptance, in the order it actually happens. First, acceptance: work that requires an AHA cannot begin until the AHA and its RAC have been reviewed, accepted, and signed by the proper approval authority (2-6.c(1)). On contractor work, the prime contractor must set up an internal process naming who can accept each level of residual risk, and that process has to be in the Accident Prevention Plan (2-6.c(2)). The manual also notes that USACE does not accept contractor risk, and contractors then submit their accepted AHAs to the KO or COR (note to 2-6.d(4)(h)). The risk acceptance table that sends E to a Division commander (Table 1-1) is in Chapter 1 and applies to USACE activities, not to your contractor AHA.
Second, staffing: a Level 1 SSHO must be assigned and on site for projects with a residual RAC of high or extremely high, and a Level 2 or 3 SSHO cannot be assigned to those projects (2-8.b(2)(f)). Third, resubmittal: if a change raises the RAC, you resubmit the AHA for acceptance before work starts, while changes that do not raise it do not need to be resubmitted (2-6.d(5)).
Common RAC Mistakes I See
Figure 9 is the short version you can tape to the trailer wall, and the details follow.
- Rating the hazard before the controls. If every row is E, the reviewer will ask what your controls are for.
- An M on every row. It tells the reviewer that nobody really thought about each step.
- Lowering severity to get a better letter. Guardrails do not make a 30 foot fall less severe. They make it less likely.
- An overall RAC lower than a step RAC. That conflicts directly with 2-6.d(4)(f).
- Citing 2014 paragraph numbers. The 2024 manual renumbered everything, and old citations tell the reviewer the AHA came out of an old file.
- PPE as the only control. The manual says PPE should not be the only protection against a hazard (2-6.b(4), Note), so work the hierarchy of controls first.
On a private job built to OSHA alone, 29 CFR 1926 does not require a RAC at all. Many general contractors still ask for one on the AHA or JHA, and the same matrix works fine there.
FAQ
Is the RAC rated before or after controls?
After. Each job step RAC shows the residual risk that remains after controls have been applied (EM 385-1-1, 2-6.d(4)(e)).
Who accepts a High RAC on a contractor AHA?
Whoever your prime contractor's risk acceptance process names in the APP (2-6.c(2)). The accepted AHA then goes to the KO or COR for review and acceptance.
Does OSHA require a RAC?
No. RACs come from EM 385-1-1 and from contract requirements, not from 29 CFR 1926.
Let Me Take the Blank Page Off Your Hands
Every AHA in the KP2 AHA Library has a RAC on each job step and an overall RAC set from the highest step, written to EM 385-1-1 or OSHA 1926 and customized with your project information. If you want to see one before you buy, grab the free sample AHA, and if you want the full walkthrough of the rest of the form, read How to Write an AHA. Questions about a tricky row? Email me at [email protected] or call the office at 410-216-4424.