Assessing risks involved in an organization IT