In a risk-based testing strategy, which two factors are primarily used to assess and prioritize risks?