Where can a project manager find risk-rating rules? Response:

A "Risk probability and impact matrix" is a tool or output that uses risk-rating rules, not the place where the rules themselves are stored or defined.

Risk-rating rules, which define how risks are categorized and prioritized based on their probability and impact, are established guidelines and templates that are typically stored within the organization's knowledge base as Organizational Process Assets (OPAs). These assets include policies, procedures, and historical information from previous projects that dictate how risks should be assessed.

Enterprise environmental factors are external or internal conditions that influence the project (e.g., market conditions, organizational culture), not a repository for specific risk-rating rules.

The "Risk management plan" outlines how risk activities will be performed, including how risk will be categorized, but the actual detailed rules and historical templates are derived from or stored within OPAs.