A common way to determine whether a risk is considered low, moderate, or high by combining the two dimensions of a risk, its probability of occurrence, and its impact on objectives if it occurs.