You have a list of requirements when generating an curve. Some of the requirements are needed so the equations you use have solutions, while some are there to prevent known attacks that take advantage of the structure of the curve.

The numbers should be choosen using a nothing-up-my-sleeves strategy, to prove that you haven't chosen them to enable an attack that isn't public knowledge yet. So you typically choose the first number that match all requirements, either counting sequentially, or using a preagreed pseudorandom sequence, like the Brainpool curves.

See for example the requirements used by the Brainpool curves - each requirement has a rationale.

Security requirements: https://tools.ietf.org/html/rfc5639#section-2.1

Technical Requirements: https://tools.ietf.org/html/rfc5639#section-2.2