Scotiabank interview question

What criteria should be consider in Risk classification?