Yes, a System Requirement can trace from a Risk. You can establish this traceability using the traceability widget or its associated field in Jira. For example, a requirement can be added as a risk control measure, linking the risk to its corresponding risk control (the requirement). Additionally, items can introduce risks, and these can also be traced using the same traceability widget.

If you are referring specifically to your trace matrix, Ketryx is highly configurable in this regard. An organization owner can adjust the trace matrix settings using our advanced configuration options. For more details on configuring traceability, refer to our guide.