How do you categorize a risk and what metrics do you take into account when doing so?

I would say use percentages, colors" red, yellow. green" or anyway you like, most important identify it and deal with it in cost, schedule and more.

We can categorise risks using risk breakdown structure. marking them high medium will be based on cost, schedule and scope baselines , quality is also a metric to be considered.

After the initial long list of identified risks, the Organizational risk tolerance among other factors decide what probability or impact rating the risk will be getting. This data is then fed into the probability Impact Matrix to find the Risk Score (Risk Score = Probability x Impact) The risks are then put in the descending order of the risk score and depending on the Organizational Policies and the Project needs, the risks are then sub-divided into High, Medium and Low Priority Risks. PMI calls this process "Perform Qualitative Risk Analysis". After the prioritization only the few very high scoring risks are made part of the detailed and costly (both in terms of cost and time) quantitative risk analysis.