Re: "Why not include critical thinking as well?"
The typical business risk assessment is "I think it's a three" - "that sounds about right".
For a fun experiment illustrating how the population as a whole fails to grasp these concepts, ask any large group of adults how many think they are above average drivers. Except in very rare circumstances, most will assess themselves as above average. People are generally crap at risk assessment and management.
Biting the hand that feeds IT
