which of the following covers the potential risks uncovered following an incident and their potential impact on the organization?