As others have mentioned, it's not so much the software, you can take legible hand-written notes and it's just as legitimate, but it boils down to the meat of the discussion of the professionals sitting down and discussing what could go wrong and who/what will be affected by those failures (or misuse). It should be thorough, but realistic. You are the one that needs to determine how far down the chain that needs to be assessed, IE single fault, etc.
Looking at your original question again, are you asking about true risk analysis and risk management, or is it simply a bullet-point list of pro's and con's to justify an update?
It is better to have enough ideas for some of them to be wrong, than to be always right by having no ideas at all.