The modern concept of risk management began in the mid-twentieth century, within insurance and financial circles. Its use expanded into health and safety, epidemiology, agricultural security and many other areas and is now a major governance tool used by private businesses and public organisations world-wide.
Though ‘risk’ tends to have a negative connotation—the assumption that something can be lost— taking a risk can also bring rewards. Risk management aims to minimise unwanted outcomes and to maximise beneficial ones.
Risk management took hold in within the conservation profession in the 1990s, though there were earlier uses, particularly as a component of disaster preparedness. Early influential publications include Robert Waller’s 1994 paper Conservation risk assessment: A strategy for managing resources for preventive conservation and Jonathan Ashley-Smith’s book Risk Assessment for Object Conservation (1999). More recently the field has come to focus on related issues such as value (e.g. what tangible elements of cultural material affect its intangible values or meaning), decision-making, subjectivity and bias, and managing uncertainty.
Risk assessments usually consider both the effects (impact) of a scenario and the likelihood (or probability) that it will occur. Qualitative or quantitative scoring methods can be used, in order to rank and prioritise risks for further attention. Qualitative frameworks use textual descriptions—for example, an event may be rare, likely or almost certain, and its effects minimal, severe or catastrophic. Quantitative frameworks use numerical data to establish priorities—e.g. documented incident rates, mathematical estimates of probability etc—and are expressed as ratios or percentages. They may also be accompanied by mathematical confidence ratings.
There are many ways of conducting a risk assessment. The IEC 2009 standard for risk assessment techniques (IEC/ISO 31010:2009) lists about 30 different methods, ranging from checklists, interviews, and brainstorming to decision trees, the SWIFT (structured ‘what if’) technique and cost/benefit analysis.
Determining the context and purpose of a risk assessment is a vital first step. To make an assessment as useful as possible, it is necessary to first define the project scope (what is to be assessed), the timeframe (both the timeframe over which the risks occur and the time you have to complete the work) and what kind of results you need (e.g. broad priorities to inform yearly resource planning, or detailed estimates for funding applications). These factors may all influence which risk management approach is chosen.
Risk management is intended to be an iterative process of risk identification, assessment, treatment (e.g. mitigation) and review. It works best when multiple viewpoints are brought together. In conservation there is a strong cross-disciplinary focus—i.e. it is not just something done by conservators, but a collaborative process that should bring together conservators, collection managers, curators, facility managers, registration and database management teams, and anyone else with relevant expertise or experience.
Two risk assessment models have come to dominate the conservation profession—the Cultural Property Risk Analysis Model (CPRAM), developed by Dr Rob Waller, and the ABC method, developed by ICCROM and Stefan Michalski of the Canadian Conservation Institute. Both use the concept of the ‘ten agents of deterioration’ as a framework for organising risk scenarios (see Canadian Conservation Institute, 2013). Both focus on the effects of physical change on collection value. CPRAM is designed for long-term collection-wide planning (using a planning horizon of 100 years) and is suited for larger or more complex organisations. The ABC method developed by the Canadian Conservation Institute and ICCROM (see Michalski & Pedersoli, 2016) is intended to be used over a wider variety of situations, from single risk analysis to long-term planning.
Qualitative matrices are often developed in-house for project management and for analysis of treatment paths, such as those used by the British Library Conservation team to manage projects such as the outward loan of the Lindisfarne Gospels and to choose the most appropriate mounting method for the Library’s copy of Magna Carta (Rogerson & Garside, 2017).
Other methods have been developed to more quickly identify priority collection care issues, which may then be subjected to more detailed risk analyses—such as the ‘Quiskscan’ approach developed by Brokerhof and Bülow (2016).
Risk management techniques are employed by a number of collecting organisations in Australia, particularly for treatments, surveys and project planning. The National Museum of Australia (2012) incorporates the principles of their enterprise-wide risk management approach into its Collection care and preservation policy, which also includes useful collection-based consequence descriptions. Museums Victoria uses the CPRAM approach for collection management and planning (e.g. see McCubbin et al, 2014).
The Australian and New Zealand Standard for risk management, first published in 1995, was incorporated into the ISO Standard for risk management in 2009 (ISO 31000:2009) and has been influential in the development of international models, including those used in conservation. (A Cannon, June 2019)