Assessing Organizational Risk and Capability