Over the past couple of years I’ve spoken several times on problems with many risk assessments, and also published an article on it (see here).
I recently ran into an article from 2005 that discusses similar issues, but especially points out problems with interpretation of a risk matrix. To read it go here.