FILL IN THE BLANK. a____risk assessment draws upon methodologies used by financial institution and insurance companies. by assigning values to information, systems, business processes, recovery costs, etc., impact, and therefore risk, can be measured in terms of direct and indirect cost.