If I've got the use case right, you want the PM to manually rank their risks/issues which will then be reported.
The main catch with what you have proposed, is that if the ranking changes or the risk closes the value will be stuck with that risk. It's also creating a lot of work to keep up to date.
if the ultimate desired output is "Top Risks" or "Top Issues", then there are ways that don't use manual ranking. (i.e. calculated risk score, weighting, date till impact etc). This will produce better MI than manual ranking which might not be done, or have any consistency and better yet is OTB. We can even limit to the top 3.
If you still want to go ahead, you'll need a dynamic lookup that reads the risks on that project and produces a array which we can then exclude the already existing results. i.e. 1 AND 3 in use , 2,4,5,6,7,n shown (where N is the total number of active risks on the project)