How can the risk factor approach be used to identify areas of high risk in an organization?