It was, unsurprisingly, the same old same old: it culminated in the presentation of a 5X5 matrix with some lovely colours and labels from low to high.
What was missed was the unavoidable error bands around any point on the map, which meant that it was impossible to differentiate between a medium and a high risk on the map. The error bands overlapped.
The result would potentially be misallocation of resources, and the inability to respond to actual risk in the real world appropriately. This is 'the risk in risk matrices'.
An excellent corrective to the reflexive reliance on the rough stepped matrix is Matthew Squair's blog Risk and the matrix. I commend it to you.
Risk is better mapped, in my view, as a series of 'isorisk' lines to guide the analyst in their determination of a risk response. Risk is not cut and dried.