Simulating risk circumstances can reveal new information to risk assessment personnel about how to mitigate risk. In one embodiment, the present invention includes selecting an asset from a plurality of heterogeneous assets of a business enterprise. The user can then input a plurality of simulated risk factors for the selected asset into the system which receives this input. The risk assessment system can then generate a non-determinative simulated risk score using the simulated risk factors, the simulated risk score being a simulated measure of risk associated with the selected asset if the selected asset were to be associated with the plurality of simulated risk factors.