How might you use the risk scenario concept in your organisation?