A risk analysis can serve as the background for establishing policies and procedures for a company.