Describir: A Model for Process Oriented Risk Managenent