NIST 800-53 controls/risk

Stigviewer.com shows impact levels for NIST controls. Is this referring directly to risk? For instance, AC-5 separation of Duties has a Moderate impact level. Is this saying that an organization not implementing this control is assuming a moderate risk impact in doing so?

If this is not the case, how would an organization or accessor determine the risk level for not implementing a certain control?

controls cybersecurity nist risk