Two risks have identical likelihood ratings but very different potential business consequences. What should prioritization consider?

1. Impact as well as likelihood and acceptance criteria
2. Only whether the systems share a vendor
3. Only the order in which they were discovered
4. Only the number of words in each description