The conceptual model presented by this paper has three steps. The first step is to calculate
the level of risk associated with each of the organization’s main activities. This follows a
conventional decision tree method, i.e. the likelihood and consequences of an unwanted
event occurring (HRI), with the addition of a weighting based on the relative importance of
each activity. The second step is to calculate the level of risk associated with the knowledge
necessary to manage the risk factors for each activity. The third step is to prioritise risks for
action by considering the outcomes of step one and step two in isolation and then in
combination. Figure 6 presents the conceptual model. The letters in brackets represent the
columns outlined later in Table IV