Assigned risk ratings are based upon:

A.
Root cause analysis.

B.
Risk probability and impact assessment.

C.
Expert judgment.

D.
Revised stakeholders’ tolerances.