Josh has devised a great platform in SimpleRisk; I'm really glad to have caught mention of it rolling by in Twitter reads. It fits really nicely in any threat/risk management program.