Suppose your organization used a qualitative risk assessment matrix with three levels each of probability and consequences (high, medium, and low). In evaluating a project’s risks, you determine that commercial risks pose a low probability of occurrence but high consequences. On the other hand, legal risks are evaluated as having a high probability of occurrence and medium consequences. If you are interested in prioritizing your risks, which of these should be considered first?

a. Commercial risk

b. Legal risk

c. Both should be considered equally significant

d. Neither is really much of a threat to this project, so it doesn’t matter what order you assign them