Modelling Risk and Identifying Countermeasure in Organizations