Over the past couple of years I’ve spoken several times on problems with many risk assessments, and also published an article on it (see here).

I recently ran into an article from 2005 that discusses similar issues, but especially points out problems with interpretation of a risk matrix.  To read it go here.