Risk analysis method integrating both technical and organisation factors