99.9% of risk assessment or risk management is as good as astrology.

Managing risk with wrong math, guesstimates has a single goal - produce enough paperwork to have plausible deniability.