IT "Risk Population"

We're doing a new IT risk assessment this year, so we’ll need to start with the population of “risk elements”. No doubt the process will be more of a struggle if the list is too long, too short, or otherwise not stratified properly.

Might any of you have such a list that you could share? My hope is that I could learn from your approach to stratifying IT risks

thanks very much in advance