Data collection and management constraints: In practice, it is very difficult to build a truly comprehensive data set – apart from the general lack of data, system constraints and a lack of standardisation mean that the required data feeds from disparate sources cannot be easily developed. This is particularly so in a large organisation. There is also relatively little availability of industry-wide data, as this depends on firms self-reporting and, by definition, it is not straightforward to gain an understanding of high impact, low-frequency events. Firms may also not be allowed to report for legal disclosure reasons.