How to sell risk assessment benefits to IT execs

You know you need a risk assessment to show that you’re secure and to find the problems that expose your enterprise to risk. But how do you sell your CEO or the board on that expensive proposition?