John works as a security administrator for uCertify Inc. His company needs to determine its security budget for the coming year. The company intgerviews candidates, administrators, and managers in the information technology division, who render ideas and commendations based upon their opinions of security risk. According to John, this is an example of what type of approach to risk analysis