As others have said in this thread I think it is very crucial to ensure that everyone attending / participating in the risk management meetings have a thorough understanding of exactly how the product works. From there as a team you should break down all the different risks associated with these 3 categories: what risks / failures are associated with the product by the “design” of the product, what risks/ failures are associated with the product by the way the end user will “use” the product, and what risks / failures are associated with the product by the way the product is “manufactured”. As a team a list of the failures should be documented for each category and then prioritized.