I agree with ds654 that the full project team should be actively involved in the process of risk identification and that every contribution of each member should be well-documented whether other members consider it significant or not. The best way to identify risks is through past experience, and this includes both negative and positive feedback. Both external and internal risks must be identified, and risks should be clearly defined. Efforts should also be made to identify whether or not the past risks were handled properly. With regards to prioritizing of risks, risks are considered as tools. As such, these tools should be aligned in such a manner that they work for the benefit, not against an individual or an organization.