In the company I work for, I’ve seen several user requirements documents as well as risk analysis forms which include user requirements embedded with defined risk levels. User requirements documents help define the product because they come from the customer’s needs. It is our job to translate the need of the customer into tangible specifications which the team can work with. With that being said, these requirements are not only included in the user requirements document but also the test plan where the requirements are assessed against each subsystem, component, overall system to ensure that the product does meet the user’s needs.