What is the straightforward approach to analyze an instance of a risk event affecting the organization in the past?