Risk assessment; dark art? Not really but it so often goes wrong. You can argue the likelihood and severity until the cows come home but the two main aims are to identify what’s dodgy and what you’re going to do to make it less dodgy. That’s it.
However, when you have decided what you’re going to do then you have to identify people to do it and you have to tell everyone about it. This is where it get hard. Take #Covid-19, I am certain the risks are identified but the communication of what needs to be done about it isn’t as successful, made all the more complex by the varying degree of risk in different areas. If you compare that to work place risk management, you start with trying not to have any risk through varying methods of managing it. The more relaxed the controls the more likely the risk will be realised.
So, when you get nervous or see a few indicators that its not going well you up the controls. The real skill is hitting the balance between controlled risk with efficient operation and tying people up making life difficult. If the consequences of the risk has greater impact than the control then it is inevitable you will go for control.