Conducting risk assessments are a valuable piece of any security program. But, in order to achieve maximum return, there’s a right and a wrong way to follow through.