Hi @CathieLe,
Risks are a separate concept within Workfront (Setup > Risk Types), and although you can define a New Risk Type, the Risk Statuses of Identified, Avoided, Mitigated and Occurred are automatically built in (good)...but cannot be modified (bad).
In addition to not (yet) supporting custom forms, this is one of several weaknesses that often drive SysAdmins to abandon Risks and instead use an Issue (sometimes even renaming one of the built in ones such as "Bug" to "Risk"), in which case, the Status tip @Madalyn_Destafney suggested would then be available.
Regards,
Doug