A
system for providing an analysis of use in managing risk, the
system including: a
knowledge base, for maintaining generic risk records each including a plurality of different fields; a
data store of profiles, for maintaining profile risk records associated with a particular profile, each profile risk
record including the same plurality of fields as a generic risk
record; and a risk processor, for updating generic risk records based on profile risk records in the
data store of profiles. The
knowledge base includes generic risk records with field values that can be refined over time so as to be useful in providing a more accurate
risk assessment in any particular profile. Some of the risk
record fields are measuring fields input by the user, and some are calculated fields calculated by the
system, and the system allows different
modes of analysis in which the fields that are the measuring fields differ. Also, in some applications, the system can be used in different
modes of use, and only some fields, depending on the mode of use, are required. In some such applications, in one mode of use for example, an inherent
risk impact cost is aggregated over an inherent cost of each consequence of the risk. A scripting facility is also sometimes provided for enabling a user to create a script directing how a risk
management process is to be performed, the script indicating steps that can be used in performing risk analysis in any profile.