There are many pieces of enterprise architecture evaluation software(s) in the industry. I am not sure how sophisticated the risk management portion of them can be, and how much utilization of the models is happening.