As others have pointed out, it's not common for a properly configured and spec'd storage backend (redundant controllers, power, switches, etc.) to go down. I'd seriously ask the PM to discuss, at length, the thinking behind rating it a common risk.
Technically, it is always worth documenting a "single point failure" as part of a risk assessment but there's a serious discussion to be had about whether or not fully redundant storage in a HA configuration represents a "single point of failure." It may or it may not depending on your org and the app. If it is a single point of failure, it's also worth discussing failure scenarios for loss of service to the whole datacenter (since it's unlikely to have a total failure of a redundant, HA SAN that left everything else up and available).
Dealing with those kinds of scenarios is pretty expensive ... redundant datacenters to start with and things like geographically stretched fabrics, multiple fully redundant SANs, "real-time replication" for the storage portion. The scenarios and apps that require these things are not all that common.
Just my personal experience:
I've run into firmware and controller bugs that cause isolated problems. On one rare occasion, I even ran into a bug that caused one controller in an active-active pair to take a dump and trigger failover. This did not cause downtime.
I have heard of nightmare scenarios such as controller split-brain or whatnot that lead to total array collapse but it is rare and it's never definitive that this isn't due to human error or misconfiguration. (human error and misconfiguration are huge issues...I don't mean to downplay them...but they aren't "spofs" in the same sense as a single SAN.)