A facility is not risky on its own. It becomes risky when it is the only path from a build to a component it needs, when the long-lead item it makes has a lead time longer than the float in the schedule, or when the capability behind it exists at three sites worldwide. Every one of those is a statement about relationships, which is why it can be computed rather than assessed.
This is the argument for resolving the sources first. A risk register maintained by hand goes stale between reviews and only ever contains what someone thought to write down. An exposure derived from the model is recomputed whenever any of its inputs move, and it finds the concentration nobody had thought to look for - which is exactly what the Console is for.