What are assigned risk ratings based upon?

What are assigned risk ratings based upon?

A.
Root cause analysis

B.
Assessed probability and impact

C.
Expert judgment

D.
Risk Identification