I think different parts of systems carry different levels of risk. Some time ago I proposed a model for assessing the risk in a granular way. Putting a value (CCD - Cost of Cognitive Debt) on individual parts may foster healthy discussions within teams. Elaborating on it here:
https://epiq.sh/blog/cost-of-cognitive-debt