List and rank each regulatory concern by its level of risk and potential impact

I am asked to develop a system management plan and I struggling with listing and ranking regulatory concerns. This plan is to have the business move to an Enterprise ERP system with a SCM and CRM.

Do I need to though come up with a numerical ranking? I keep thinking it wants a calculate results from the likelihood x potential impact Is just a list enough or is it a gird ranking them with some sort of calculated number?