How to Conduct Risk-Based IT Compliance Self-Assessments