Will an IT consultation include a risk assessment