Scoring risk without believing the number
Probability times impact gives a number that looks like a measurement. It is two judgements multiplied, and it is useful for exactly one thing.
What the score is for
Probability 3 times impact 4 gives 12, and 12 looks like a fact. It is two guesses multiplied. A risk scoring 12 is not meaningfully worse than one scoring 11, and treating the ordering as precise is how registers end up with forty items ranked to two decimals and no decisions attached to any of them.
What the score genuinely does well is separate the top few from the rest. Use it for that and stop.
Bands must scale with the grid
On a 5×5 grid the maximum score is 25; on a 3×3 it is 9. If "High" is defined as 12 or above, the same judgement is High on one grid and impossible on the other.
Bands should be proportions of the maximum, so 15 out of 25 and 6 out of 9 both land in the same place. Fixed thresholds are how a risk rated High by one team becomes Medium at another with no change in the underlying view of the world.
The blind spot
Multiplying probability by impact systematically under-weights the rare catastrophe. A one-in-a-hundred event that ends the project scores low and belongs at the top of the agenda.
This is a limitation of the method, not of any implementation. The practical defence is to look separately at anything whose impact sits at the top of the scale regardless of probability, and to treat "unlikely but fatal" as a category of its own rather than a low score.
Inherent and residual
A register recording one score per risk cannot tell you whether your controls work. Recording both makes the claim explicit — we believe this control moves this risk from 15 to 8 — and an explicit claim can be challenged.
When residual equals inherent, either the control does nothing or nobody updated the numbers after it was put in place. Both are worth finding out.
Unowned means unmanaged
The best predictor of a risk being ignored is having no name against it. A risk owned by "the project" is owned by nobody, and it will be discussed at every review and acted on at none.