Risk models and risk factors are different. Risk models are made up of the myriad risk factors that affect how an organization manages their information security.