I think one reason why companies get risk analysis wrong is because they know it requires a lot of work. What I mean by this is that once risks are identified and a plan is put out to deal with those risks, part of doing the risk analysis is to follow up with those tasks. If a new risk is identified along the way that maybe wasn’t thought of before, that also requires a plan to be mitigated to be put into the risk matrix. As stated before by others, risk management requires a lot of “up-keep” because you should be updating it along the development process. Other mistakes include trying to find the “easy way out” of completing the risk analysis and not taking into account any small detail that could impact the performance of the product.