This article examines how the various approaches to implementing and administering organisational risk management have evolved over the last 30 years. It considers the growing realisation that effective risk management requires greater participation from across the organisation, a reliable process by which to capture risks, and a mechanism by which to document and administer the organisation's response. It will consider the relative benefits and limitations of the three most common approaches; paper-based, spreadsheets, and risk management software.
As organisations increasingly recognised the need to proactively manage risk, questions arose about the most effective approach to actually doing it. The majority of organisations understood the need for a mechanism or process capable of capturing risk information from across the organisation, and the requirement to document and distil captured information in order to facilitate an effective response.
For most organisations, this saw the emergence of a paper based risk management system, combining an extensive set of meetings, forms, and written reports to capture risk from across the organisation, escalate it, and allow the organisation to coordinate its risk management response.
With the rise of personal computing, spreadsheets increasingly came into play, eventually becoming the key tool for recording and analysing risks data. Risk management spreadsheets, combined with some basic coding evolved to do more and more, including neat little features like changing cell colours in response to risk scores to produce a Red, Amber, Green (RAG) status. They also allowed risk data to be filtered and analysed. However this step forward, didn’t resolve the broader challenges of risk management.
