I currently work as an R&D engineer for a medical device company, and have had some experience with working with the QA (quality) department on risk analysis. As our professor has mentioned in this week’s lecture the identification (assessment) of risks usually occurs in a brain storming team meeting. Generally the philosophy I have seen taken in order to try to identify all possible risks associated with the product is by asking the question, “What can possibly go wrong with the product?” From there you try to think about and identify all possible failure modes and misuse scenarios in which can possibly occur. That approach should cover the vast majority of the identification piece, but there may be some additional risks that will need to be identified based on each specific product. Prioritization should generally come from the output of what would happened if the identifies risk actually occurs. If the outcome of a risk could cause death or serious injury it should treated with high priority, and if the outcome of a risk would mainly be related to customer annoyance with minimal adverse effects than it should be treated as low priority.