Risk sources are where risks originate. Risk sources are not categories, although treating them as categories could help identify and define other risks, or facilitate development of the risk breakdown structure. Categories sort risks to aid in identification. Sources generate risks