According to the PMBOK® Guide and the Standard for Risk Management in Portfolios, Programs, and Projects, risk ratings are the primary output of the Perform Qualitative Risk Analysis process.
The assignment of these ratings is fundamentally based on the following two dimensions:
Risk Probability Assessment: Investigates the likelihood that a specific risk will occur.
Risk Impact Assessment: Investigates the potential effect on a project objective (such as schedule, cost, quality, or performance) if the risk occurs.
By combining these two variables, typically through a Probability and Impact Matrix, the project team can calculate a Risk Score (Probability $\times$ Impact). This score determines the risk ' s priority level (e.g., Low, Medium, High), which is the " assigned risk rating. "
Choice A (Root cause analysis) is a tool used in Identify Risks to understand why a risk might happen, but it does not provide the numerical or qualitative rating itself.
Choice C (Expert judgment) is a tool/technique used to help determine the values, but the ratings themselves are formally based on the assessment of probability and impact.
Choice D (Revised stakeholders ' tolerances) influences the thresholds (what is considered " High " or " Low " ), but the individual risk rating remains a product of its specific probability and impact.
