![](bg4.png)
the D-organisation (D from Documental). The
I-organisation supports the O-organisation by re-
membering, sharing, and deriving facts. The D-
organisation supports the I-organisation by storing
and fetching documents, or data. An organisation’s
essence is captured in its O-organisation and the on-
tological model of an organisation’s O-organisation is
called its essential model (J. L. Dietz, 2020).
In the O-organisation, Original Production acts
(P-acts) generate original, new P-facts (J. L. Dietz,
2017). A P-act can be the preparation of a cup of
tea and the corresponding P-fact is the cup of tea
(J. L. Dietz, 2020).
The core elements of an organisation’s essen-
tial model are the actor roles, C-acts/facts and
P-acts/facts. In DEMO Specification Language
(DEMOSL)-3, the essential model of an organisation
consists of four aspect models: Construction Model
(CM), Action Model (AM), Process Model (PM) and
Fact Model (FM) (J. L. Dietz, 2017).
The CM is the ontological model of an organisa-
tion’s construction: contains the actor roles, the trans-
action kinds between actor roles and the information
exchanging between actor roles. In DEMOSL-3, the
CM is represented in an Organisation Construction
Diagram (OCD), a Transaction Product Table (TPT),
and a Bank Contents Table (BCT) (J. L. Dietz, 2020).
The AM is the ontological model of an organisa-
tion’s operation, it comprises action rules that spec-
ify the P/C-acts that must be carried out, along with
the P/C-facts that must be assessed. In DEMOSL-3,
the AM is represented in Action Rule Specifications
(ARS) (J. L. Dietz, 2020).
The PM is the ontological model of an organi-
sation’s state space and transition space of the Co-
ordination World. Concerning the state space, the
PM contains the process step kinds and the applica-
ble existence laws of transaction kinds. Regarding
the transition space, the PM comprises the coordina-
tion event kinds along with the applicable occurrence
laws. In DEMOSL-3, the PM is represented in a Pro-
cess Structure Diagram (PSD) (J. L. Dietz, 2020).
The FM is the ontological model of an organisa-
tion’s state space and the transition space of the Pro-
duction World. Concerning the state space, the FM
comprises all identified P-fact types. Regarding the
transition space, the FM contains the production event
types. In DEMOSL-3, the FM is represented in an
Object Fact Diagram (OFD) (J. L. Dietz, 2020).
3.2 IT RM Activities Analysis
The essential model will be based on the IT RM ac-
tivities’ definitions provided by the ISO 31000:2018
and PMBOK 6. The standards were analysed in order
to identify the O-organisation transaction kinds (O-
transactions) and actor roles, following DEMO.
When analysing the activities’ definitions, all
realisation aspects of an organisation were ig-
nored. These are I-organisation transaction kinds
(I-transactions) and D-organisation transaction kinds
(D-transactions). All implementation aspects are dis-
regarded, i.e., the technologies that perform the P-acts
and C-acts. Additionally, we abstracted the specific
subjects that fulfil the actor roles (Perinforma, 2012).
To identify the O-transactions of IT RM we con-
sider the following criteria: Original P-acts/facts en-
compass manufacturing, transporting, observing, de-
ciding, and judging (J. L. Dietz, 2020).
In the definitions of the activities, their O-, I- and
D-transactions are highlighted in italics.
Communication and Consultation, as stated by
ISO 31000:2018, is defined as "Communication seeks
to promote awareness and understanding of risk and
the means to respond to it, whereas consultation in-
volves obtaining feedback and information ..." (ISO,
2018). Only I-transactions were identified, since
these are about sharing and remembering facts.
According to ISO 31000:2018, Scope, context and
criteria starts with "The organisation should define the
scope of its risk management activities", then "The
context of the risk management process should be es-
tablished ...", and finally "... define criteria to eval-
uate the significance of risk and to support decision-
making processes" (ISO, 2018). Three O-transactions
were identified, since they are related to creating
something new: T1 scope defining, the actor role is
A1 scope definer; T2 context establishing, the actor
role is A2 context establisher; T3 risk criteria defin-
ing, the actor role is A3 risk criteria definer. These
three transactions access organisation data.
Identify Risks, according to PMBOK 6 is about
"identifying individual project risks as well as sources
of overall project risk ...". This standard advises the
involvement of experts, so that "Individual project
risks and sources of overall project risk can be iden-
tified..."(PMI, 2017). Two O-transactions were iden-
tified, since they are about creating something new:
T4 risks identifying, the actor role is A4 risks identi-
fier; T5 individual risks and sources of overall activity
risk identifying, the actor roles are A4 and A5 subject
matter proficient. During the process of carrying out
T4, the corresponding T5 is initiated, therefore is said
that T5 is enclosed in T4, implying that A4 starts T5.
In order to identify risks correctly, it is necessary to
access information that resulted from T1, T2, T3 and
also to access data from the organisation.
According to PMBOK 6, Perform Qualitative
On IT Risk Management Ontology using DEMO
261