> ... and that there is an opportunity for "consultants" who understand this, kind of like security consultants?

Risk management consultants already exist! Many companies just choose to assess it internally, or the consultants themselves are inexperienced (often lacking practical experience).