The IEEE standard 29119-3 defines the content one should include in a test plan. One such part of that content is the *Risk Register*. This standard specifically states of this register:

> 
> Identifies the risks considered by the testing covered by this plan. This should include any relevant risks that may be specified in the Organizational Test Strategy. Provides an exposure level for each risk based on its impact and probability. Provides recommendations to treat the risks.
> 
> 
> 

They specifically recommend that this register be broken into a *product risk register* and a *project risk register*.

My struggle here is in figuring out how to define a proper set of risks. I have a product which must meet a certain set of requirements so in my mind, the risk is that we won't meet these requirements. But it seems unhelpful that my risk register should list the risks as:

> 
> 1) We don't meet requirement 1  
> 
>  2) We don't meet requirement 2  
> 
>  ...
> 
> 
> 

with the accompanying mitigations being

> 
> 1) Test to make sure we meet requirement 1  
> 
>  2) Test to make sure we meet requirement 2  
> 
>  ...
> 
> 
> 

**How can I define proper risks and accompanying mitigations which are meaningful? What should I consider in defining a product/project risk?**