I have no experience with risk analysis, but i think there is no major difference between the medical device and pharma world. After doing a little research I found a website/pdf that broke down the quality risk management process which is very similar to the medical device. Those steps are:
1) Risk assessment
2) Risk control
3) Risk review
Within those steps there are sub points, the interesting thing is that they all link up to risk communication after each step are you communicating to update the risk.
https://www.pda.org/docs/default-source/website-document-library/chapters/presentations/ireland/quality-risk-management—the-pharmaceutical-experience.pdf?sfvrsn=6

I think I may have to disagree with you a bit the brain storming process happens, but it is not as thought through are we may like on the outside looking in. Companies focus on making the technique easier because it’s a business risk doesn’t make them money, if they can produce a product fast what do they have to loose.