The purpose of a consequence model is to discipline an employee in order to ensure future compliance with information security policies.