Risk assessment most commonly focuses on two criteria - impact and likelihood. As an organization's risk assessment process evolves, there might be other criteria might be valuable to consider. Please list the criteria and explain why these criteria should be considered.