Recruitment of a consulting firm to support on-site IT risk assessments