I am just about to start a new role with other 30 sites, each one presenting a variety of credible risks. I am happy with the risk assessments but my thoughts are moving towards the actual data. With so many sites I will have multiple sets of data. Rather than chuck all this into one bucket I want to try and manage it so the data is not duplicated and can be managed efficiently. I reckon if I get it right I can then use the unique data to analyse and learn from it. After looking around I don't see many 'best practices' for managing the data. How is this data converting from a piece of A4 paper into a database of time king? Or does it remain an A4 scan on an intranet? My search on the www reveals a lot of companies out there all trying to flog their software solutions. Naturally all published without pricing because it is no doubt a ridiculous number. Any suggestions or best practices out there? Thanks in advance :)

Depends somewhat on the levels or risk in your organisation, and the current maturity of your HSSE-MS A tiered approach to RA would help, each level becoming increasingly specific. Data flows between each level. The approach we use is as follows: L1 - Corporate HSSE risk registers

---

These contain the catalogue of hazards/risks across your organisation and here you specify the minimum mandatory controls. This provides you with the maximum allowable risk levels (tolerable) for people doing a particular activity no matter where it is in the world e.g. confined space entry. If appropriate you can code the hazards as per an ISO standard such as 17776. L2 - Risk Assessments

---

These are specific to a site / location / project. They adopt the controls from the risk registers above and incorporate additional controls based on local needs / local legislation. L3 - Job Safety Analysis

---

These are specific to a particular task at a particular location, and are a subset of L2. These levels combine to produce a RA framework and enables the prioritisation of resources toward addressing those risks having the highest potential risk level Your question is how is all this data captured and utilised? You need to tie all these into your Incident Management Tools and audit processes. You need to have common templates, common risk matrix and good RA training. L2 RA's are a subset of L1. However, L2 helps to determine the risk levels on L1.

I would start with common things such as site set up. Create a procedure and go from there as they must have some common themes