Is risk a good way to approach this situation?
Yes, a risk based approach is always a good idea. :)
Does my reasoning make sense? I.e. No sensitive data, backed up, other controls, etc then OK to remove the PIN
Generally, using PINs vs not using PINs depends on your threat model and a few other factors/considerations.
Consider the external factors ...
There are many commercial asset management solutions that auto-discover assets and their relationships such as Service Now.
Then the discovery scans run daily or weekly on a schedule to keep it up-to-date.
Of course, nothing is perfect so it has to be put directly into the shoulders of the server and app owners to on a recurring basis and after any change ...
There is no such thing as "no risk". There is always residual risk. Therefore, management must accept some level of risk (known as "acceptable risk").
"Inaction" is not the same as "accepting risk". What you are seeing is management not wanting to make a decision that costs money. That's all. There is no "risk thinking" here, so you can't look at it ...
SOAPUI is a good tool to execute a DAST (Dynamic Application Security Testing).
Another good open source tool is OWASP ZAP. There are also a bunch of commercial ones.
It's not the tool you are testing with, but the web attack payloads it runs against your application. If two of the tools have the same web attack payloads, there is no need to use another ...
You are not going to find a standardised metric because that's not how risk works. Figuring out how adverse events will have an impact is the whole point of risk management.
What would present a risk to a major university will be vastly different from what would present a risk to a 3-person app development start-up.
2.1 Anti virus ...