Developing a Risk and Security Management System

management system which consists of four different stages. The objective of this study was to create that system. The system consisted of four stages, risk management plan, emergency plan, crisis management plan and a business continuity plan. Action research was chosen to be a research method for this study. The Governing Body of Suomenlinna requested that the risk management plan and the business continuity management plan would fill the requirements that the International Organization for Standardization (ISO) defines in their standards 31000 and 22301. The rescue plan was meant to fill the requirements of Finnish legislation, rescue act 379/2011. The crisis management plan was created using examples from other Finnish government agencies and earlier documentation from the Governing Body of Suomenlinna. The project started in spring 2014, and it ended in September. The creation of the plans and the system went according to the timeline which was set in the beginning of the project. One of the key objectives for the system was to make it simple enough that it could be understood by every employee of the Governing Body. Therefore it was decided that the documentation should be thorough and limited. This objective was reached with careful planning. Th