We want to undertake a comprehensive review of the security of our IT
systems, and their vulnerability to both internal and external risks. 
Please advise on best practice in this area, and whether there are any
generally-accepted approaches to assessing and evaluating risk in this
context.

We are a UK law firm with about 100 PCs, all at a single site.

As far as I know the closest thing to what you want is would be the
Common Bodies of Knowledge (CBKs) for the CISSP security
certification.
http://www.isc2.org/cgi/content.cgi?category=19

There are many books avaliable that cover this content.  They are
typically geared towards people wanting to pass the CISSP
certification, but I beleive they would be of use to you even if you
don't want to go for the CISSP.

One book I can personally recommend is The CISSP Prep Guide: Mastering
the Ten Domains of Computer Security by Ronald L. Krutz, Russell Dean
Vines, Edward M. Stroz
http://www.amazon.com/exec/obidos/tg/detail/-/0471413569/qid%3D1046449967/sr%3D1-5/ref%3Dsr%5F1%5F5/

Better to call in an outsider with specialist knowledge.

Like me.