Risk Management as Numerology?

Doug Gale examines quantitative risk analysis in this article titled The Myth and Reality of Risk, which focuses on IT but obviously has broader connotations:

When we get to the final cost-benefit ratio everything may seem logical, but does it make sense, or is it just numerology?

The traditional view of risk management plots the probability of an event from very low to very high on one axis, say the vertical, and the impact of that event from very low to very high on the horizontal axis. The first priority is to deal with risks in the upper right of the graph, the ones with a combination of high impact and high probability. The ones in the lower left, low impact and low probability, get the lowest priority.

It's all so logical. What can go wrong? As I see it there are three places we can go astray.