Who Owns Your Risk Data?

Public entity risk managers are expected to make decisions every day that affect facilities, budgets, insurance costs, and operations. Those decisions are only as good as the information behind them. Unfortunately, that is where things often get complicated. Engineering assessments come from one source. Jurisdictional inspections come from another. Insurance carriers perform their own reviews. Specialty consultants may be brought in to address a particular concern. Each provides valuable information, but the information often ends up stored in different reports, systems, portals, and email folders. Over time, assembling a complete picture of property risk can become surprisingly difficult.

This raises an important question: Who owns the information?

Too often, risk data follows the service provider rather than the organization. Reports become difficult to locate years later. Recommendation histories are spread across multiple systems. Key decisions were documented somewhere, but finding the supporting information can require a scavenger hunt worthy of a facilities professional armed with coffee, determination, and access to an old shared drive. If you have worked in public risk management for any length of time, you have probably seen a version of this firsthand.

Imagine a university that has spent years addressing sprinkler deficiencies, electrical reliability concerns, and aging infrastructure. Projects have been completed, recommendations have been tracked, and significant investments have been made. Then the insurance program changes. A new carrier conducts its own engineering review and identifies many of the same concerns discussed years earlier. The risk manager remembers the history. Facilities leadership probably does, too. But the CFO may be new. Legal counsel may have changed. Board members and executive leadership may have rotated. Suddenly, people are digging through old reports and emails trying to answer a seemingly simple question: "Didn't we already deal with this?"

The information still exists. The challenge is finding it when it is needed.

This is where an unbundled approach to risk engineering can provide value. Rather than relying exclusively on engineering and inspection services bundled into an insurance program, organizations can engage independent engineering resources that work directly for them. These providers can perform many of the same services traditionally associated with insurance carriers, including property risk assessments, recommendation tracking, and jurisdictional inspection support. The difference is that the organization owns the resulting data and can retain it regardless of future changes in carriers, brokers, or service providers.

Technology can further strengthen that advantage. When engineering reports, recommendations, and inspection results are stored within a risk management information system (RMIS), individual site managers can access their information, track progress, and respond to recommendations more efficiently. Risk managers gain a portfolio-wide view of exposures and improvement efforts, while executive leadership can quickly understand key risks, investment priorities, and trends across locations.

When organizations maintain control of their risk information, decision-making improves. Historical findings remain accessible. Capital planning discussions become easier. Leadership gains better context for investment decisions. Insurance renewals become more productive because the organization can clearly explain its exposures, improvements, and priorities. This is particularly important for public entities. Universities, municipalities, counties, school districts, and special districts often manage large and diverse property portfolios while balancing limited budgets and competing priorities. Decisions made today can affect operations, insurance outcomes, and facility resilience for years to come.

Effective risk management is not about collecting more reports. It is about retaining information, preserving context, and using both to make better decisions. Engineering reports, inspections, and assessments are simply tools. The real asset is the information they create.

Public entities already own the risk. They should own their data, too.