If you're not familiar with it, FAIR (a quantitative risk framework) should give an organization the tools to do this.
From the website:
Factor Analysis of Information Risk (FAIR) provides a framework for understanding, analyzing, and measuring information risk. The outcomes are more cost-effective information risk management, greater credibility for the information security profession, and a foundation from which to develop a scientific approach to information risk management.
FAIR allows organizations to:
- Speak in one language concerning their risk
- Be able to consistently study and apply risk to any object or asset
- View organizational risk in total
- Defend or challenge risk determination using an advanced analysis framework
- Understand how time and money will impact their security profile
In short, using FAIR you can produce a risk "number", which can be a dollar (or pounds) value for the risk.
This can then be "compared" objectively to other risks, on an equal scale - as opposed to comparing apples and oranges (or more commonly, apples and purple).
Note also that this does not apply only to technical or computer risks....