One of my recent BAU Scrum teams ran a fortnightly risk review meeting. The risks were prioritised according to probability and impact and tracked in a risk register spreadsheet in Excel.

If there were Stories that the Team could work on to mitigate risks, these were added to JIRA. The Stories in JIRA and the risks in the risk register were linked.

The importance of the risks became part of the business value that the Product Owner considered when he prioritised Stories for each sprint.

When the stories were DONE in a given iteration, both JIRA and the risk register was updated.