Hi Karen,
It's a big topic...will do my best to answer your questions!
We use the Issue object to record Risks and Issues. We do not use the standard Risk object.
The reason we do this is so that PMs can log Risks and if they eventuate, then convert them into an Issue simply by changing a "Risk Status" custom field. The obvious benefit is you have the link/history to when something was a Risk and save users time compared to creating a new Issue manually. The main draw-back of having Risks using the Issue object is that users need to click the "New Issue" button to create a Risk. It's a bit confusing but overall is worthwhile we believe.
Scope creep is something we have not addressed specifically in Workfront yet, but we plan to do so in the near future...probably using Change Requests.
Yes - Impact Type is a check-box. Be aware that if you choose to do this, you lose the ability to group by them....not sure if I would choose a different field type in retrospect but it is working OK for us at the moment.
Yes, 'SEVERITY' is a custom field with a format of Number. Options are: Extreme, High, Medium and Low. It has values associated to each of the options, which are used in a calculation (Severity is multiplied with another custom 'PRIORITY') to determine an overall Issue Rating.
Lessons Learned Reports are used (generally) to produce the contents for the Lessons Learned meetings.
Hope the above helps. If you wanted some assistance setting this up, I can put you in contact with the consultants (Work Management Australia) who implemented it for us originally.
Regards, David.