Risk Analysis for IT Landscape

Dear all,

I'm currently involved in a process to decide whether or not carring out an 
(additional) risk analysis for the IT landscape.

We currently dealing with the SOX404 act and wondering whether an additional 
risk analysis is useful and valuable for consideration. I believe that SOX has 
dealt in depth with risks, but from my point of view it is more control 
orientated. What means that SOX doesn't really care about the probability of 
the risk. And it is also only belonging to financial reporting (well, if a 
system breaks down, it perhaps harm the finacial reporting of cource, but not 
necessarily do it)

However, it would be interesting if you could post some of your experiences in 
such area. Success stories and benefits of risk maps would especially be of 
interest for me. Perhaps somebody could give me a hint to some good sources 
measuring benefits versus cost of an IT risk analysis (costs are always the 
"show-stopper").

Thanks a lot.

Regards
Maik