A risk assessment can be easy or complex, depending on your expectations. Are you only looking for perimmiter assessment, internal controls, policies, procedures, processes, physical access, data archives, emergency response procedures, etc. Thereis a lot to look at. Simple tools will allow you perform a quick scan and, if you are knowledgable in this field, help you identify weak areas.
There are vendors that will do this for you and consult, leaving you with an executive view of your company linking to more detailed information. These vendors are really expensive. You may want to try a company called Checkyoursix located at checkyoursix.com. They are pretty reasonable.