Assigned risk ratings are based upon:


A. Root cause analysis.
B. Risk probability and impact assessment.
C. Expert judgment.
D. Revised stakeholders' tolerances.