Where can a project manager find risk-rating rules?

Where can a project manager find risk-rating rules?

A.
Risk management plan

B.
Risk probability and impact matrix

C.
Organizational process assets

D.
Enterprise environmental factors