Understanding the Risk Before Choosing the Tool: The Enterprise Risk Assessment