Why can I only select some users when assigning a risk or while creating an approval request?

Assigning a risk:

Users can only access risks when the user can also view or edit the initiative this risk belongs to. Therefore when changing the owner of the risk you can only choose between the owner and the team members of the initiative (or its parent initiative).

Asking a user for approval:

A user needs to be able to access the business case or benefit when he is asked for approval. Therefore when an approval request is sent for the business case, only the owners and team member of the initiative (or parent initiative) can be selected.
When an approval request is created for a benefit, you can additionally select the owner of the benefit or its team members.