In terms of the how risk is prioritzied in my company, an assessment is made on the impact of the risk (monetary, time, liability, etc.) If the issue is one deemed high risk (will cost much money, and has high liability) these are deemed higher priority and are dealt with as soon as possible (think resulting in NC’s and CAPA’s or dealing with production issues). In addition, issues that impact production or customer service are treated witht he highest priority. Other risks that are considered moderate cost or liablity are dealt with after those, with not as much urgency. Even lower risks will be pushed off until there is funding and need to alleviate those risks.