In the risk prioritization step, the overall set of identified risk events, their impact assessments, and their probabilities of occurrences are “processed” to derive a most-to-least-critical rank-order of identified risks. A major purpose of prioritizing risks is to form a basis for allocating resources.