The methodology is based on the application of the fol lowing steps: > assessment of the inherent risk, in other words the probability of a critical event occurring and the re lated impact, in the case of there being no control activities aimed at mitigating the risk itself; > assessment of the level of control, in other words the effectiveness of the existing management and con trol activities specifically implemented to manage or mitigate the risk; > calculation of the residual risk: by applying the level of control to the inherent risk, it is possible to obtain the residual level of risk which represents the Com pany’s risk exposure.