Introduction

The previous chapters have outlined the stages that comprise a risk management process. However, as well as following these stages a number of activities should be carried out on a continuous basis. These can be summarised as:

• documentation;

• communication; and

• audit.

Documentation refers to the process by which all aspects of the risk management process are recorded, whilst communication refers to collation and circulation of information, both within an organisation and between that organisation and outside agencies. The final process, audit, covers the ongoing validation of the risk management process.

Whilst the scope of documentation and audit are relatively straightforward, communication covers a wide range of overlapping areas. The systems used to keep track of information could be described as monitoring, whilst the circulation of key items of risk information is also referred to as reporting. However, rather than trying to separate these items arbitrarily, they are included in the same section.

Documentation

Risk registers and their roles in the identification of risk have already been discussed. However, it is important to document the risk management process much more broadly. This means that the reasoning behind the process as a whole should be documented. However, there should also be adequate documentation of all decisions taken, and the reasons for those decisions.