How can I change the items that can act as Risk mitigations?

This can be done in the admin client:

When you go to Project Settings and Risks, you can define which categories can act as Risk control categories.

In the following video (direct link here), we show you how to add a category of items as Risk control: