Time to abandon the risk matrix? I find the risk matrix to be an excellent tool.
It enables you to define risk in a way that people understand.
Stuff that kills you will always be Critical or Extreme but other than this its all about qualitative assessment which for 95% of risk is probably all we have.
Riki Brown did exactly that, he just didn't label his assessments but he started at Critical and presumably ended at High, Medium or Low.
The end result is then determined by what the controls are and this in turn controls how often the controls need to be checked. Easier if they have labels (eg high = 3 monthly, low = 12 monthly, etc)
When dealing with Critical risk, scenarios should be considered, then the controls for those scenarios, the supporting controls, specific responsibilities; also where to find the specifications/procedures.
All of this is best achieved, in my opinion, with the use of a risk matrix. If nothing else, the process is at least consistent.
Once at this point, the residual rating can always be changed if the controls are found to have gaps upon review.
But it is not the rating that counts its the controls and how you can measure whether they are working.
Safety risks are pretty straight forward based on how many injuries occur despite controls. But when it comes to health risk, measurement practices are also controls - eg: eyesight, hearing, lung function testing, etc - whatever is required to measure the effectiveness of any controls designed to prevent acute/chronic health issues.
I would like to see a standard risk matrix, one not only specified by WorkSafe but also by ISO and used across all standards (9001, 14001, 45001, etc). I believe this would make risk more understandable and people would develop a greater in-built sense of risk, a bit like they have an in-built ability to determine distance, time, etc.