How to get all (or most) risk assessments, regardless of type (software, hardware, integration, management, external, etc.) justifiable, repeatable and comparable.