I am continually surprised and depressed by some of the mistakes that people make when assessing risk. One of the more common, and I have to say ignorant, mistakes is to treat subjective category descriptions as numbers that can be analysed statistically.
I recently came across a reputable international organisation that assessed risks using six categories of likelihood and six categories of impact, on a six by six matrix, form very low to very high. This organisation labelled the likelihood and impact categories 1 to 6, and then undertook some statistical analysis as if the category titles meant something numeric.
For those of you who don’t see what the problem is, imagine that the six categories had been called Oranges, Bananas, Pineapples, Pears, Apples, Mangos rather than 1,2, 3, 4, 5, 6. Now, how can you undertake statistical analysis on Oranges, Bananas, Pineapples, Pears, Apples, and Mangos. Get the idea?