This is reference for types of risk. I am not a risk professional but having a hierarchy of risks is the only effectively way to manage agreegation of risks and data risk as required by some regulatory guidelines.
Risk References used to create master risk list
These could apply to any business capability, and need to be applied in each case:
These are risks that can only be managed once a financial understanding of activities and operations has been established:
These are risks that could disrupt the overall operation of the business model: