Rethinking the risk matrix