One of the hardest parts in documenting your risks is figuring out the root cause of the risk being analyzed. If this is done poorly, we will spend time and money treating the wrong root causes and the risk may only get worse.
Take the Great Plague of 1665 that killed 1/6 of London’s population. It was believed that dogs and cats harboured the plague so the Mayor had hundreds of thousands of dogs and cats exterminated. As it turned out, rats and mice carried the fleas that carried the disease (that bit the humans). With their natural predators extinct, the rats and mice population grew and the disease multiplied exponentially. Huh.
So think about those root causes.