Risk prioritization is a function of both impact (severity) and likelihood (probability). The highest priority is assigned to risks that pose the greatest potential threat to an organization's objectives. A risk with a high impact, even if it only arises occasionally, represents a significant threat that could have severe consequences on finance, operations, or reputation. Standard risk management frameworks, such as the one defined by COSO and taught in the CIMA syllabus, use a risk matrix (or heat map) to plot risks. Risks in the high-impact/high-likelihood quadrant are the top priority. Option D, with its high impact and non-negligible likelihood ("occasionally"), falls into this critical category and warrants more immediate attention than the other combinations presented.

A. While the high impact is a major concern, the low likelihood reduces its immediate priority compared to a high-impact risk that is more likely to occur.

B. Frequent risks with low impact are typically managed through routine operational controls and do not represent a strategic or catastrophic threat.

C. Risks with both low impact and low likelihood are considered the lowest priority and are often accepted by the organization without specific action.

1. CIMA P3 Official Study Text: The CIMA P3 syllabus covers risk assessment, which involves mapping risks based on their likelihood and impact. The principle is to prioritize those with the highest combined score. High-impact risks are always treated with high importance. (Reference: BPP Learning Media, CIMA P3 Risk Management Study Text, Chapter 4, Section 3.3 'Risk maps/heat maps').

2. COSO Framework: The Committee of Sponsoring Organizations of the Treadway Commission (COSO) framework, which heavily influences the CIMA syllabus, emphasizes assessing risk severity. "Severity of risk is considered at multiple levels... The organization assesses the severity of risk as a combination of impact and likelihood." High-severity risks are prioritized for response. (Reference: COSO, Enterprise Risk Management—Integrating with Strategy and Performance, June 2017, Principle 12, Page 69).

3. Academic Publication: Risk management literature confirms that risk prioritization is based on a combination of probability and consequence. Events with high consequences (impact) are prioritized for treatment, especially when their probability is not negligible. (Reference: Aven, T. (2016). Risk assessment and risk management: Review of recent advances on their foundation. European Journal of Operational Research, 253(1), 1-13. Section 2.1 'The risk concept'. https://doi.org/10.1016/j.ejor.2015.12.023).