Traditional risk calculation methods are typically based on CVSS score and a simple business impact model (high, medium, low). A major drawback of this approach is that it prioritizes based on severity, not by risk to your business.
A more accurate and actionable risk calculation method uses 5 factors –
Vulnerability severity
Threat level
Business criticality
Exposure/usage to the risk
Risk-negating effect of any compensating controls an enterprise has in place
This results in very accurate prioritization and helps you avoid needless busy work fixing low priority issues.