This is a rather unspecific question, so I will answer it in a rather broad manner.
The most formal and widely accepted explanation for this can be viewed in ISO/IEC 27005:
Risk assessment consists of the following activities:
- Risk Identification
- Risk analysis
- Risk evaluation
Risk assessment determines the value of the information assets, identifies the applicable threats and
vulnerabilities that exist (or could exist), identifies the existing controls and their effect on the risk identified,
determines the potential consequences and finally prioritizes the derived risks and ranks them against the risk
evaluation criteria set in the context establishment.
Your question was, how risk assessment can improve the information security policy?
An information security policy sets goals for information security within an organization. When planning on how to achieve these goals, this organization has to define the respective process, the needed ressources, responsibilities etc. To define these key aspects, you have to conduct an information security risk assessment. So risk assessment is not just improving an information security policy, it is mandatory.
For further information you should give the international standard ISO/IEC 27005 a read. The whole process and it's benefits are explained in full there.