A key step in the process of gaining this assurance is conducting a risk assessment, an activity that entails a comprehensive review and analysis of program operations to determine where risks exist and what those risks are, and then measuring the potential or actual impact of those risks on program operations.
There is never a need to measure risk.