ISO/IEC 27005:2011 is the ISO standard providing guidelines for risk management and contains a lot of advice for the assessment part of that process. A ridiculously abbreviated summary might be:
- Identify the risk by:
- identifying your assets
- identifying the threats to each asset
- identifying the existing controls protecting each asset
- identifying the vulnerabilites in each asset that the threats might exploit
- identifying the consequences of harm to each asset
- Analyse the risks by:
- determining likelihood of harm (i.e. loss of Confidentiality, Integrity, or Availability)
- determining the impact of harm
- combining those values to assign a level of risk
- Evaluate the risk by comparing the level to your acceptable risk threshold
You would usually do the identification step by taking inventory of your assets and interviewing their owners and maintainers about them.
The analysis stage is usually qualitative and fairly simple. For example, you might assign values of Low, Medium, or High to both likelihood and impact of each risk, then have a simple table showing the consequent risk value. High likelihood and high impact means a high risk, and so on. This seems rather simplistic, but it's very hard to give precise quantitative values to likelihood and impact across all your risks. What's the likelihood that my office will burn down next week? Spock might estimate the probability as 2.457% but I'm human, so the best I can do is estimate it is "Very Low". Your circumstances may be different, of course.
Finally the evaluation stage is simply comparing the level of risk to what you find acceptable, to see if the risk needs treatment. Again, it's a little simplistic, but the reason you're doing analysis is to determine a) what risks you need to treat and b) what order to do them in.