A Structured Approach to Risk and Impact Analysis