Eric,
I agree with Lassitude. I use the
FMEA format for many different types of Risk Analysis. What you will need to do is to create a rating system for Severity, Occurrence, and Detection if you can not find an accepted "industry" format. It is important to keep in mind that you are the authority for your processes/products provided you do not have to observe a mandated (regulatory) standard or practice. These authorities will need to discuss and agree what the rating (scale) system will be. I recommend that you all are in full agreement prior to starting this process as it isn't recommended that you change the process midstream.
Regards,
Kevin