It’s often the small things that make or break a big project. For a risk assessment, that’s often the ability (or inability) to manage all the information you’re gathering

By now, you should have picked up that a successful risk assessment is a combination of high-level and tactical thinking and both soft and hard skills. This is one of the reasons that flying solo is so difficult: even if you have a mix of all the required skills, you need to switch between them frequently

One of the most overlooked parts of the risk assessment is managing all of the information that you’re going to amass over weeks – months even – of research, interviews and workshops. It’s very easy to start gathering information and for it to quickly get out of hand with a mixture of annotated company reports, print-outs of documents, notes from interviews and flip charts from workshops. At least if you are working by yourself, you have an idea of where everything is but imagine how quickly this becomes a mess when you have a team of people involved in the assessment.

Importantly, this isn’t just a case of keeping things neat and tidy for the sake of it: if you cannot collate and review all the information you’ve gathered, then you aren’t going to be conducting the assessment with a comprehensive picture of the organization. That’s not to say that you need to gather every possible piece of data, that’s impractical. But you need to be able to find and access all of the information that you’ve gathered.

Most importantly, you are conducting a process that may have a significant effect on the organization. As such, and particularly if something doesn’t work out or there’s an incident in the future, you might need your notes to be able to go back and review what information you had. In the worst case, you may need these as part of an investigation or legal action.

So when it comes to managing your data, there’s not really such a thing as too much organization. Here are a couple of things to keep in mind that will help.

Think more is better

There’s not really going to be a time when you have too much information: issues concerning the time, availability of data, and access to key individuals mean that you will almost always be missing some information. Therefore you need to gather as much as possible while you are in the Understanding phase. And if information is available but you don’t think you need it, grab it anyway.

Annual reports? Check! Sets of SOPs? Check! Incident reports? Training Logs? Check and check!

Digital storage is essentially free and takes up no physical room so keep whatever you can at this point. You never know what you might need to turn to at a later date and you can always dispose of peripheral documents once the assessment is over.

Write for someone else

Write your notes as though someone else is going to have to read them because they are: future you! What seems like an obvious abbreviation or contraction today could be meaningless in a few weeks time. Also, be accurate with the date / time / location / source of the information. ‘London, January 12’ isn’t going to be much use if you conducted six interviews that day and collected two documents. Also, if you need to take photos, make sure you will be able to remember where and when the image is from. Something I’ve found helpful is to take a context image, such as the front of the building or a map showing where you are, before you start with detailed images. This helps future me separate a series of similar photos at a later date.

Cross reference

Similar to the issues that abbreviations can cause, quotes or pieces of data you capture need to be put into context and referenced. This is something that I continually mess up when I’m researching online and I close out a dozen tabs at a time and then have to re-open each one to attribute the quote or data. Something I’ve found helpful is a browser plug in the captures the URL of every tab you have open. So I capture all the key points I want from my research and quickly copy and paste all the URLS into the bottom of the source document. This literally saves me hours each month.

A quick note on quotes

Quotes are incredibly helpful to make your point in a report but these can cause contention where someone disagrees with the point and then targets the individual. Therefore, I usually explain at the beginning of an interview that I might quote answers but these would always be anonymous. I keep a note of who said what for myself as this is useful if I need to go back for clarification but I avoid including anything the identifies the source in any of the report documentation.

Back up, back up, back up

It goes without saying that you need to back up your work. This goes for paper notes too so scan these into a back-up location online, ideally daily but at least weekly. Again, make sure that each page or set of notes is clearly identifiable both on the page and in the file name.

Identify and collate themes

A lot of what I’ve talked about here is to help manage the raw data but as you collect and collate your information, you can begin to flag themes and recurring points. You need a system for this, particularly if there’s a team working on the assessment so find a way to mark up notes so you can quickly pick out themes. If you have already determined the threat categories then you could mark items as ‘threat’, ‘objective’, ‘vulnerability’ mirroring the definition for risk you are likely to use. Whatever system you use, this will help you pick out the key data points when it becomes time to bring the report together.

A friend of mine back in the military was fond of saying that the path to excellence was ‘small things, done well, consistently’. Managing your data is an example of a seemingly small thing but something essential to your success. Without an effective way to manage your data, your risk assessment will at a minimum, be much more difficult. At worst, it will be inaccurate because your data, and therefore your understanding, will be incomplete.