Paper on why I need a security Assessment

["Matt McClung" <mmcclung () ndwcorp com>]

I am looking for a good paper on why a company should perform a security
assessment.  Not the What is an assessment type of paper, but a WHY - If I
don't do anything then what?

Example:  If you don't check the configuration of your web server, you may
leave a default server setting that allows for a system compromise using a
well known scripting tool.

Anyone have a link to something like this?

Matt