Last month I had my transition audit to IATF 16949 and for risk analysis I use the Turtle diagrams, I have 18 processes so I had 18 Turtles, one thing that we did is that we kept the risk and opportunities to a minimum of 3 since you have to have plans to address this risks and opportunities. The only observation that I had by the auditors is that I had more turtles (sub-processes) than the 18 declare, so I would advise to just do the turtles for the processes declare.