Risk analyses are seen as a vital tool for crisis prevention and developing capability to respond to future crises. In Sweden, all municipalities are required to perform risk and vulnerability analyses as a basis for their crisis management work. The aim of this paper is to study how and why a risk and vulnerability analysis can become a part of an organisational process for learning how to prevent and prepare for crises. This is done through a study of civil servants in Swedish municipalities and county administrative boards about how they develop and use risk and vulnerability analysis for creating a crisis management capability within the organisation. It is shown that the results from risk and vulnerability analyses normally are not transferred within or beyond the municipalities and that the learning within the organisation and within society is thus limited. © 2023 The Author(s)