Risk impact criteria are PRIMARILY used to:

Risk impact criteria define the potential consequences of a risk event occurring. These criteria are primarily used to prioritize risk responses. By understanding the potential impact of different risks, organizations can focus their efforts on mitigating the most significant risks first.

While impact criteria can inform risk appetite (A), their primary use is in prioritization. Determining loss associated with specific IT assets (B) is part of impact assessment, but the criteria themselves are used for prioritization.