How can I change the items that can act as Risk mitigations?

This can be done in the admin client:

When you go to Project Settings and Risks, you can define which categories can act as Risk control categories.

In the following video, we show you how to add a category of items as Risk control: