I believe that all the responses here are very valuable and they offer very good methodologies on how risks are identified. From my experience, Risk identification starts from the intended use, intended users and use environment. Once all these have been defined for a certain device, risk identification process can start. The process starts with identification of potential hazards related to use, user and use environment. A good starting point to that is utilizing Annex C of ISO 14971. Answering the questions available in Annex C will provide you with preliminary hazards that could occur when your device is in use.

The identified hazards are then associated with certain harms that result from that hazard. The harms are then assigned severity. In each FMECA build for this project, the harms, and hazards will be tied to a hazardous situation which should be mitigated.