I don’t have the industry experience yet, but from what I was reading on the PMI website, I understand that the risk identification is always followed by the risk management planning step. Risks can always be identified through a detailed studying and analyzing of the Risk Management Plan. This could be done by understanding the project objectives, the success factor of that project, and the way to avoid these risks. Information from different sources could be useful in this process as they could find a similar risk that occurs earlier at a different company and learn how they avoided it and earn from others mistakes as well. Also, another tip is to document the possible risks along with their long-term consequence, causes, etc. All the steps during risk identification should be recorded for future projects and improvements.
More steps could be found at study dot com website (risk-identification-process-analysis)