Think of the impact in terms of how management would view it. If it were to delay the project, how long might it be delayed? If it were to cause a feature to fall out, what’s the loss in value of losing that feature? Why would management care? It’s not uncommon, after distinguishing the impact of a risk, that you realize your risk isn’t as bad as you thought it was—even if it happened, the project would still succeed. Or you might discover it’s far worse.