Spot on. In the Coast Guard we have a similar operational risk assessment model called General Assessment of Risk (GAR)[0], which uses six categories and a score of 1-10 in each to get a cumulative score, which corresponds to either Green (low risk), Amber (moderate risk), or Red (high risk). In a best-case scenario, all involved in the operation will conduct a GAR brief as a group, and the person doing the brief will solicit the group for what number they would give for each category, and the highest number anyone calls out is the one the whole group goes with. Typically, if somebody calls out a 5 or higher, they are asked to explain why they feel the risk in that category is so high. Once the reasons are identified, the group then "mitigates" the risk by discussing the identified reasons so that everyone understands the risks. The score is tallied, and the color (risk level) is identified.

That is the best-case, textbook way to run the model. Still very subjective pseudo-science, masquerading as objective risk management, but at least has something of a method to it.

In practice, the repetitiveness of the GAR model results in many crews blowing it off, and giving a vague, arbitrary cumulative score without any discussion around how they got there. This sounds bad, and by policy it is bad, but in practice I have observed no discernible difference in how crews approach risky missions and operations when they conduct a full GAR brief or just give a somewhat random score and move on. In other words, the GAR model does not seem to provide any tangible risk management benefit, and largely seems to serve as a bureaucratic CYA solution.

GAR was introduced in an attempt to reduce the number of mishaps occurring due to what was deemed to be excessive risk-taking. The statistics may demonstrate that it had that effect, though I would argue from my perspective that other training programs introduced to address problems related to risk assessment have far more deckplate-level impact and effectiveness. The problem with GAR is that it tries to objectively standardize something which is, by its very nature, dynamic and subjective. No two people, in the exact same situation and having the exact same capabilities and experience, assess the risk the same way. Assigning numbers to a series of broad categories and giving a color-coded risk level to the situation does not inform anyone of anything very useful. Discussion of risk factors is more helpful, but due to the way the system is structured, is a step frequently skipped.

What matters far more is focusing on continuous, dynamic training and education of those in billets for whom risk management is a critical part of the safe completion of their mission, and emphasizing clear communication unfettered by rank or positional authority to ensure that everyone has full situational awareness. Be respectful, but make sure that information can move freely between all involved.

[0] https://www.uscg.mil/hq/nsfweb/foscr/ASTFOSCRSeminar/Present...