I know the areas of risk in a group of companies based on a Risk Breakdown System.
With what model shall I analyze them afterwards? Is FMEA good for this purpose? If yes, how should I apply it?
Most risk methods shall help the applicant to not forget any aspects. Risk management is about achieving awareness and identifying corresponding and supporting activities (IMHO).
So, I go with PMI: Perform a qualitative risk analysis regarding risk probability and impact using values like high, medium, and low.
Afterwards, perform a quantitative risk analysis, e.g. by FMEA or other tools in order to get „real“ (and provable) numbers (e.g. cost in case of risk occursnce).
As Tob has provided, I find PMI's framework easier to apply. Depending on the complexity, and to answer your question, you can certainly apply FMEA as well. If you need a reference, you can use NASA's criteria definitions and charts (see Fig 1-2):
It boils down to documenting and ranking:
These will help you come up with the associated Risk Priority Number (RPN). This data, as the name suggests, will allow you to come up with mitigation/action plans based on the priority and tackle the identified risks accordingly.