How can I change the items that can act as Risk mitigations?

This can be done in the admin client:

When you go to Project Settings and Risks, you can define which categories can act as Risk control categories.

Note: when you make a change in the Risk configuration, you will be asked to re-index the whole project or do it manually (one by one)

For example, you would like to add a category as risk control, do they following: