The appropriate timing for an initial risk identification session can be somewhat tricky to determine but it should be held early, soon after the basic program requirements, milestone dates, etc. have been outlined, but before the budget and business case are baselined. Done properly, the risk identification session should identify areas that require additional effort, money, time, etc. impacting the business case/budget.