As already discussed by others, the best ways are a quality system supported DFMEA matrix, collecting information from various sources such as the complaints department and the past quarter’s CAPAs and NCRs, SWOT analysis and others. I believe the best way on handling the risk identification is to periodically update the assessments every other quarter with as many sources of information as you can possibly obtain. Not only does it force people to look critically at what has been done before but it also triggers internal action (such as CAPAs and the like) when risk is approaching a pre-established threshold.