Cointegration really shouldn't be a risk relationship. It's a sort of equilibrium pricing relationship.
If you take a bunch of prices/yields and regress them in levels, you are looking for a 'fair value' (or rich/cheap) analysis for pricing. If you look in differences you are looking for the hedges. The analysis is very different.
In effect, cointegration is like an infinite-horizon correlation. It only tells you what will happen in the long-run. Its impact on the short-run is limited. It does have an impact, but this is for forecasting (some famous analysis showed that cointegration relations do not really help that much with long-run forecasts, but do in fact help with adjustments to short-run forecasts).
To use cointegration for risk just does not make sense. First, as a risk manager, you want to look at returns. Returns are $I(0)$. You can't have cointegration relationships between $I(0)$ time-series. They're already stable. You would never look at risk using price levels themselves, either, right? That would not make sense. But that's where you'd look for a cointegration relation.
Another way of looking at it is, it's valid to find cointegration using PCA, but PCA in levels. IF a set of $N$ assets (in prices, $I(1)$ variables) has $k$ cointegrating vectors, then it has $N-k$ common trends, which are $I(1)$. In other words, our $N$ assets are linear combinations of $k$ cointegration relations and $N-k$ non-stationary time-series. PCA always searches out the highest contributions to variance, but $I(1)$ variables must always be higher contributors to variance than $I(0)$ (in the long-run, of course, since I think we can imagine cases where this is not true in the short run, i.e., comparing a high variance Ornstein-Uhlenbeck process to a very low-vol Brownian motion. In the long-run the BM will have higher variance, while the OU will have bounded variance).
PCA in levels is sometimes used as an (inefficient) means of extracting cointegration relations.
I think it's best to leave the cointegration to traders. Yes, if they find a relationship that seems stable with nice carry, then they should try to take advantage of it. As a risk manager, you must poke holes in their theory and show them that the cointegration relationship sometimes breaks quite severely! (To do so, you can find changepoint detectors in cointegration relations and try them out, or just look at the cointegration relationship over different time periods and see if the coefficients drift or break).