What is root cause analysis, and how is it helpful in managing risk?