We think about architecture in terms of its capacity to describe existing systems or its ability to induce runtime properties, but we often do not spend enough time thinking about its role in security. An architectural risk assessment (ARA) is an organizational activity that should be done periodically, usually at the beginning of a project or prior to a major refactoring. It is an attempt to align security goals with business goals and to measure and describe the risks associated with systems and the people who use and design them. It is also a useful approach for considering potential for abuse and how that can be mediated. We will discuss an overview of the approach and its various activities.