Risk Matrices Don’t Work, Says Report from the Government Finance Officers Association

“Another reason that risk matrices can be counterproductive is they act as an ‘analysis placebo,’ where
decision-makers think they understand the risk because they have subjectively characterized the risk as
‘high,’ ‘low,’ etc. But, because the risk matrix is not based on hard data about the chance of loss and the
potential magnitude of loss, decision-makers are overconfident about how well they understand the risk.
Though risk matrices are easy to create, easy to understand, and inexpensive, if they lead to lower
quality decisions, they aren’t a good deal. The alternative to a subjective risk matrix is to quantify risks.”