Why Businesses Should Conduct Annual Security Risk Assessments