Quick answer: A colourful risk matrix is not a map of reality, NASA learned that the hard way. Risk-informed and risk-based decision-making are not the same thing, and confusing them has real consequences for how organisations actually decide.
Originally published on LinkedIn: 13 February 2026.
The distinction between risk-based and risk-informed decision-making is more than semantic; it represents a fundamental shift in how organisations handle uncertainty and complex data.
Two different logics
Risk-based decision-making focuses on quantifying risk through structured technical analysis, probabilities and cost-benefit trade-offs, to select options that minimise negative outcomes or residual risk (Afita & Pasaribu, 2025; Pasman et al., 2021). Risk-informed decision-making integrates that same analysis with broader contextual factors, stakeholder values, ethical considerations and uncertainties that cannot be fully quantified, allowing qualitative judgment to sit alongside quantitative data (Amendola, 2002; Keisler & Linkov, 2020). At NASA, where the margin for error involves billion-dollar assets and human lives, the agency has concluded that risk-based decision-making, relying on fixed, often arbitrary ratings, is a liability; static matrices are often the tombstones of failed projects.
Why risk-informed performs better
Risk-informed decision-making supports ongoing evaluation and adaptation as new information emerges, addressing uncertainty more effectively than static risk-based methods (Glette-Iversen et al., 2023; Krewski et al., 2022). Empirical work in entrepreneurial SMEs shows that integrating risk management into decision-making improves decision quality by balancing risk mitigation with value creation (Crovini et al., 2020).
Dynamic risk and Bayesian networks
Contemporary frameworks emphasise continuous reassessment as decision alternatives, risk levels and context evolve (Glette-Iversen et al., 2023). Dynamic Bayesian networks extend traditional Bayesian networks to model how risk variables and their dependencies change over time, incorporating equipment ageing, operator response times and environmental conditions, and are now used in chemical processing, maritime navigation and offshore drilling to provide continuous risk monitoring and decision support (Barua et al., 2016; Perez et al., 2025).
Conclusion
The academic and regulatory consensus is consistent: risk-based approaches rely on quantitative thresholds alone, while risk-informed approaches treat quantitative analysis as one input among engineering judgment, safety margins, regulatory requirements and operational experience. For complex, high-consequence environments, risk-informed decision-making is the more mature, pragmatic framework, because it balances analytical rigour with practical, human-centred judgment without sacrificing accountability.
Tony Ridley provides security, risk, safety and resilience advisory for organisations that need evidence-based, board-ready decision support. Contact us to discuss your requirements.