The methodology envisages the following steps: the probability of a critical event occurring and the related impact, in the case of absence of con trol activities aimed at mitigating the risk itself; 2. assessment of the level of control: assessment of the effectiveness of the existing activities to manage or mitigate the risk; 3. calculation of the residual risk: calculation of the residual level of risk by applying the current levels of control to the inherent risk.