If I have to formulate goals for a project there's the well established S.M.A.R.T. paradigm. It helps to have goals at the end, from which necessary actions can be easily deduced. It prevents from having goals which can be interpreted differently thus causing a lot of problems with stakeholders and sponsors.
I wonder if there are similar paradigms for formulating risks when doing a risk analysis. I often find myself searching for risks by just mindmapping them over every topic which comes to my mind or doing that together with a team. The amount of theoretical situations and constellations posing risks is often overwhelming. Within an hour of a meeting we wrote down and counted 60 terminal nodes on a mindmap representing some sort of risk in different areas and points of view. I think we are not bad in "risk identification".
The thing is, those "risks" found by mindmapping tend to overlap and are often formulated in a way that they describe sometimes the risk itself, sometimes the cause and sometimes a failed mitigation and mixed cases from all that.
e.g. if I try to assess the risks of cleaning my bathroom (of course so I can skip that this week to reduce overall risk) I find a lot of opportunities where i can stumble on slippery surfaces. I can use inapproriate detergents which are corrosive to my bathtub as well as to my skin, eyes and aspiratory system and even exacerbated by inadvertedly mixing them together. But if I want to break down the "inappropriate detergent" which is maybe more a cause for a risk than a risk itself I get a lot of overlapping risks, because i can harm my skin with different chemicals but those might or might not ruin my bathtub's enamel. That's what I want to name "overlapping risks".
I hope you get my point. I think you can't asses risks in a reliable way if you can't formulate them well. I'd like to have some kind of a touchstone to check, if a risk is well formulated. Same as there is for goals.