The organizations are more interested in the impact that can generate risk and in particular associated to IT. Every day it is possible to see that different business of sectors like: finance, governance, health, production, among others, they are reporting economical lost due to fails or attacks over theirs IT services, which can affect the reputation, relationships with the clients and their self financial and operational robustness. There are two fundamental pillars for the risk analysis: standards and norms and the other side the methodologies; with these pillars along is impossible to assure the results without the governability of this risk analysis. In this paper, we show what kind of standards and legal documents must be considered in a risk assessment process and after we are going to explain how is possible to use a methodology and how to connect this methodology with the IT governance process in a successful way.