The specific risk analysis methodology used can vary by organization because of differences in missions and the difficulty in qualitatively and quantitatively assigning risk levels.
Risk analysis helps organizations.
Risk analysis does not help organizations.