You mentioned two of the big factors: Severity (S) of the failure and Occurrence (O) of the failure. These determine how serious the problem is, and how often it happens. A third factor which my company uses is the Detection (D) which is how likely you are to be able to detect the problem. These three factors are given numerical values and then multiplied together (SxOxD) to get the Risk Priority Number (RPN). The values mentioned are usually discussed in a meeting of representatives from quality and manufacturing engineering departments to make sure the correct prioritization is given to the failure. If a new solution is discovered which lowers the risk, these values can be modified as a reflection of the process or design improvement.