The Intersection of Martial Arts and Business Success

I was martial arts full-contact champion in the style of jiu-jitsu I trained, professional bodyguard, probably at the top of my game. Got a phone call, it was my mother. This was back in South Africa. She was on the way to hospital after my stepfather had been shot in the head in an attempted carjacking. Rushed to the scene, got there, there were 2 guys looting the car. Drew my firearm, I had it on them, depressed the trigger, I almost shot both of them. They were both police officers who were looting the car. But it was a fundamental turning point for me because at that point, As I mentioned earlier, carjack avoidance was one of the biggest selling programs we had. I did not train my family, and that's been a life lesson for me continuously. It does not matter how good the expert is if they're not there when you need them. How do we perpetuate the knowledge?

Okay, welcome everybody. We've got Dr. Gav Schneider here on the show with us today, um, and you've said I can, I can drop the doctor, but not after sort of giving a bit of context about what that's about— a doctor of criminology, which I found fascinating. So Gav's one of our Mastermind members, also located up in Brisbane, and has been kind enough to fly down and join us in the studio here in Melbourne today. So, so Gav, I'll give a little bit of background because I know this is going to be a fun interview with lots, lots of, um, lots of gems. So the theme that we've got today is around rethinking risk, um, so more of a sort of a practical approach to risk and performance. Um, so tell me, we're going to open in sort of a different way. Martial arts, bodyguard, entrepreneur. I feel with risk as the topic Knowing that you're a black belt, knowing that you're a doctor but not a doctor that could help me in surgery, maybe I'm at risk here. But Gav, I'll just, I'll just open up the, the conversation there. What has that got to do with where you are now?

It's a very good question, Dave, and a big question. But to, to your point around what sort of doctor, you know, jokes aside, I'm the doctor who can tell you what not to do ahead of time, not what to do once you're in trouble already. But, uh, No, practically, I started my career training and teaching martial arts. I still train and teach. I really enjoy it. It's been a very good escapism for me. That got me into the world of high-level security back in South Africa where I grew up and started my first business.

Yeah.

And I kept evolving myself continuously. So, my real passions are business and protecting people. So, by integrating those 2 things, I've been able to really build a pretty good business career. But equally, you know, I think it's a constant journey of what needs to be done now versus what was done even a year ago. And things are changing so quickly, there's not a static kind of environment.

Yeah.

So to directly answer your question, I think a myriad of skill sets is very, very useful in a fast-paced, changing world.

Yeah, I mean, I can, I can imagine being in South Africa, being on, what do you call it, on patrol or in mission or in In persona, you'll have to help me with the language, but like the time to make decisions, the risk mitigation that's going on. I mean, maybe talk me through some of those heightened things because that might have a little bit to— I think I can see a thread already starting to develop.

So Dave, you can clearly see you haven't made it to the point where you need your own personal bodyguard.

No.

Otherwise the jargon would flow a little better. But I guess the, the real fundamental piece is around understanding the likelihood of something bad happening as your starting point. So, my whole journey has been really driven by decision-making and risk, which are 2 aspects that I really fell in love with early on in my career, primarily because, to be honest, I just kept seeing so much bad decision-making around me all the time.

Hmm.

Whether it was, you know, a lady who comes to mind who contacted our South African office telling us she needed carjack avoidance training. And I actually picked up that call and said to her, well, sure, why? You know, believe it or not, in South Africa, that was one of our best-selling products, right? With roughly 80 carjackings a day, people want to know what to do. Um, and I just asked her casually, why? She said, well, I've been hijacked 4 times. Like, well, how did they do it? Oh, they hid behind the same bush each time. You sort of hear things like that, and then you go, but Why have you not cut the bush, put up some lights, change some of your behavior? And continuously, that was probably one of the driving pieces behind my career. If I even look from an executive perspective, you know, we would, for example, look at staff incentives. As my first business, which we started in Africa in 2000, grew, and that grew to about 150 staff working in about 32 countries, doing everything from training presidential protection teams to fraud investigations, Right. One of those key things that kept linking pieces together was how do you make a great decision at the right time based on all the challenges we've got? And, you know, fast forward realistically 15, 20 years since I started with that conundrum, I spent a lot of time in my PhD researching high-consequence decision-making under stress and how do we train people to do that better. And then in teaching a psychology of risk program for almost a decade at postgraduate level, I really got to dig deeply and tinker. So, you know, these were things we could use in our consulting business. These were things I could use in my own business. And practically, the ability to make great decisions is a universal requirement for anybody who wants high performance.

So just on that, Gav, is there a, um, is there a linkage or, um, The time to make a decision, is that if you make it quicker, does— are you more likely to make a better decision? So knowing that you've gone deep in the literature, is speed your friend?

We can go really deep into this, but realistically, people often say to me, Gav, you've been teaching decision-making and risk and resilience, and you run a business that does that. I don't want to come and do a 1-year program at uni. Just tell me the short, the short story. Like, how do I, how do I get good at this? And this is, this is the fundamental challenge. All anyone can ask of a leader, an executive, or to be honest, anybody else that has to make a decision, is to make the best possible decision in the most appropriate timeframe based on actual intelligence, which is verified and vetted information, not perception. But then we look, for example, and I'm sure many of you, the listeners, will be familiar with the work of the late Daniel Kahneman. who, Nobel Prize winner, um, came up with this idea of what he referred to as System 1 and 2 thinking. So System 1 thinking being your fast, quick, intuitive decision-making, System 2 being your deep analytical decision-making. And his research kind of showed us that we make most of our decisions using System 1, the quick intuitive piece.

Is that the different part of the brain?

It's not that it's a different part of the brain, it's a different part of our neural architecture.

Right.

So we can also superimpose— and this is going to be an interesting chat because now we're going into the neuroscience side of it a little— but there's, there's another researcher, Professor Matthew Lieberman, who, who found something he refers to as the neural seesaw in his research, which really shows that we can't be both emotive and factual at the same time because we use the same neural architecture. So what tends to happen with great leaders is we seesaw quickly between those. Good decision-making is also a seesaw between those. So, the challenge we've got is if we use System 1, which is our intuitive-based decision-making, at best, we might get a decision right, say, 80% of the time. And that's with a highly trained, well-informed, evolved intuitive capability. The real lesson with this is to know which are those critical decisions that require to use System 2, the risk manager of the mind. The big challenge that we actually have is if we look at the way this rolls out in most organizations, and I don't want to pick on financial services, but they're often an easy one to do because they're so regulated. And as a result of all this regulation, you know, there's this perception that regulation equals performance and regulations equal better risk management. My experience has not been that. Okay, you— we like to divide sort of the way we look at risk into 3 categories: compliance, the stuff you have to do; resilience, what you need when the stuff you have to do goes wrong or isn't enough; or pre-resilience, which is the ultimate state of high performance. And, you know, the point we like to focus on, which is how do I develop the right balance of compliance, so the stuff I have to do; Mm-hmm. The right balance of resilience, so I have enough reserves or ability to respond to a disruption; But equally, then I can shift to proactive prevention and opportunity centrism. We found very few companies can get there. So, to directly answer your question earlier, being able to make a decision quicker is only better when you have a small window of time to make that decision. If I have a bigger window of time, why wouldn't I want to get more facts, more information to make a more informed decision?

So, just on what you're mentioning there, it's funny you mentioned financial 'Cause we were in a mastermind session and the group chair was from financial services, actually our company chair as well, Mike. And he was talking about how, you know, as kids and growing up, we're sort of conditioned to suppress our intuition or intuitive sort of feelings about, well, you know, push your feelings down or, you know, don't really listen to your gut.

Yeah.

really sort of follow in that sort of a thread. But you talked about sort of later in his career, he would become— he became a lot more intuitive, didn't feel the need as much to focus on having the 8 green boxes ticked, but just knew that something was a good decision. Is intuition, you're saying sort of System 1, can this be learned? Or can it be trained, or can it be honed, or is it—

Absolutely.

Okay.

And you kind of ask about my background. I would say that my martial arts and close protection career helped me develop quite a highly attuned System 1, mainly because a lot of those decisions required there— if you think about martial arts, and depending on how you do it, you know, obviously you can do it for sport, you can do it for health, you can do it for survival. If you look at the worst-case survival driver, you have a split second to make a decision. That consequence could cost you or someone else their life. So, we have to look at how do we train that capability. So, to your example, what happens over time, and this is the real interesting piece, experts can't predict the future any better than laymen. All right, so there's this perception that because you're an expert, you can see further forward.

Mm-hmm.

What experts can do is process the information and come up with likely outcomes with a far higher, greater degree of certainty or accuracy, but we could never guarantee it. So, to your point, over time we prime the subconscious. So, if you don't train your subconscious properly, you prime it badly, which is why we often see, you know, boards and executives make terrible decisions even though they should have known better, because they're reflecting back on what they've been through to get to the point they're on. That's what's primed the subconscious. Very often what we're facing around us, particularly today when things are moving so quickly, You know, geopolitical risks are insane. You know, we've got wars on multiple fronts, we've got cybersecurity, cyber safety, AI, you name it, all these things intersecting. We often don't have the luxury that we used to of things moving slowly to give us time to analyze and gather information. Yeah, conversely, we've got the world's information available at our fingertips. The big challenge we face today though is the misinformation, disinformation, malinformation challenge. So just because you've got information doesn't mean you'll make a better decision. You have to convert that information into usable intelligence.

Yes, I had an example of that. I was on holiday with, with my wife Alison, and we, um, I looked up, uh, I was just new to TikTok, and so I was looking on TikTok and it talked about the submarine being found. And then I told everybody that I was with that the submarine was found because I read this article on TikTok, which turned out to be someone making an article about a submarine that was never found. And so that was, yeah, a good example, well, an example of misinformation. But just knowing that you're sort of working globally, you're working locally, approaches to risk or, you know, general overview in risk, are we— We get a bit of a reputation to be maybe risk-averse here. And you mentioned the B word, boards. So there seems to be an increasing evolution of regulation coming in the front door with maybe nothing going out the back door. You mentioned financial services before, which is probably one of the most regulated industries. How are we sort of placed in your view around, you know, our organic sort of behaviours here and how that plays out in business versus what's happening in other parts of the world?

A really good question, Dave, and practically it might be worthwhile, I guess, from an audience perspective, I've operated so far in about 18 countries, Many of those were on the security side of things, but I've run businesses in South Africa, I had one in Mauritius, we had an incorporated entity in the UK, we had one in India, and we're busy exploring opportunities now in the US. So I have seen a few different business cultures and how they work. It's fascinating. So for me, I guess I go back to when I arrived in Australia nearly 16 years ago. What I was used to was a a layer of respect for professional capability and credibility. So often what would happen with us with clients in many emerging markets was they would come to someone like me by reputation. They'd go, XYZ has referred me to you, therefore I trust you already, tell me what I need to do to solve my problem. Conversely, setting up a practice which— when I started my business here, we originally started with security, which was a comfort zone for me. We then acquired a safety training business, merged in a medical health business, and in 2013, the modern version of Risk2Solution was born as Australia's leading integrated risk management business. Um, it was fascinating to kind of see the converse of that. So, for example, some of the early jobs I picked up here, if I had to do a review on security architecture for a water utility business, for example, which we did a few of those.

Hmm.

just to change where cameras sit, you need a full risk assessment, an action plan, a project management plan, a WHS, SWMS, the list goes on for something that would have taken not even a minute in a less bureaucratic structure.

Yeah.

I've had many of my psych risk grads, and we've probably had 300 or 400 of them over the years, and some of them are some of Australia's leading chief risk officers, come to me. And one of them recently said to me, I'm not going to say which government department he works for, but he actually said to me, used the soccer analogy, and he said, there's so much risk aversion here, they would rather lose the game 100-nil than take the risk of scoring an own goal.

Hmm.

So, when you look at that, that crushes entrepreneurism, it crushes innovation, it makes us slow and non-competitive. So, practically, to directly answer your question, yes, I think we've actually, in Australia, we've hurt ourselves, and we're still continuing to hurt ourselves with the mindset of More regulation, more compliance will drive better behavior. The world has changed so quickly around us that geopolitically, and even if we look at global supply chains, you know, we are in a global economy. So practically all we're doing is we're making ourselves less competitive.

Hmm.

And we're— Australia is incredible. I feel so blessed every day to be here with my family. It's safe comparatively. Don't get me wrong, bad things happen, as we've all seen in the last few months. But still, even with all of those, we're comparatively pretty safe.

Yeah.

You know, we're pretty wealthy. It's been incredibly difficult to start businesses from scratch here and build them to the point that they're at. I'd probably say if you are an entrepreneur in Australia and you make it, you could make it anywhere. The entire system significantly seems to push against entrepreneurialism, and the drive to be a big business, not a small agile business, is significant. just to be taken seriously. Like, I look at us, up until we were, say, 300, 400 people, it was really hard to pick up decent-level large contracts.

Right.

So, you kind of have to grow first to be big enough to convince everybody you're not a risk, as opposed to coming up with a good innovative idea or solution. But it is a journey. And to directly answer your question, we've got a lot of work to do. I mean, there are some incredible leaders, and even in the Mentorless Program, it's been really nice to see other leaders in the same conundrum.

Okay.

The challenge we've got though is, and I'll just call it as it is because I believe your listeners are highly educated professionals from what I've seen, you know, our labor force is not very competitive. Our work ethic is not really good compared to many other countries. The hunger and the want for career growth is, it tends to vest with a smaller portion of the population. It's a really hard place to run a high-performing, innovative, agile business compared to other places in the world?

Well, it's funny you should mention that. I was, well, I was chatting with one of our members this morning who's got business in China talking about a 996 work week. And I'm like, what's a 996? She's like, 9 o'clock to 9 o'clock, 6 days a week. But if you're a manager, you've got the 997 roster, which is 9 to 9, 7 days a week. I'm just thinking, oh my gosh. Now that is, I mean, that is a work ethic and shows the aspiration of, you know, individuals in this part of the world, which is Shenzhen, China, which is just, that is the norm there. I just found that absolutely fascinating that that is a norm there. And then you look at sort of some of the, gosh, just some of the conversations that you have here around getting people to return to the office or just the whole dynamic of employee-employer. Don't get me started, this is a bit—

But Dave, your point is really interesting. Because it's fascinating for me. Like, we adopted work from home in my business way before COVID Yeah. We got agile work going. For me, it was always, I don't care where you do your work, I care about your outcomes. To do that, you have to have a high-trust organization.

Yeah.

To have a high-trust organization, you have to really be good at risk. Because if I trust the wrong people, they make bad decisions and we land up in trouble. If I have the wrong culture, we can't get integrated high performance. And it's fascinating, people often look at my career and I started, you know, punching and shooting really, like that was the frontline piece. And about 2015 or '16 when we started running a lot more of the human centricity, I brought a few behavioral scientists onto staff. I would often get asked, but Gav, you're a security guy, why are you bothering with cultural change or people performance? And the honest answer for me was always, well, the reality is if you hire us to do some work for you, whether that's a consulting piece of work, a training piece of work, or even give you manpower, if your culture is not aligned and we haven't created the right value stream which aligns that culture for high performance and outcomes, whatever I sell you is not going to work as well as it could. It might not even work at all. And there was a strong ethical driver for me in my business. We like to say, make a dollar, make a difference. We're not a— we're a for-profit business, but why would you want to waste effort if you can't move the needle? And practically, the projects we've had the best outcomes are the ones where we're able to implement human centricity, where we're able to train an integrated package of leadership, high performance, and decision-making as a package, including my own business where we've rolled this stuff internal.

Fantastic. Um, so you mentioned a word before which I don't think is actually in the dictionary— presilience. Um, you mentioned sort of when we're talking about the System 1, System 2, um, You know, you need compliance, you need resilience, and then you mentioned presiliency, which I imagine comes before— well, anyway, maybe you can explain that a bit further.

With pleasure. So I'm glad we got to that because presiliency is probably— I mean, I'm not 50 yet, but it is my life's work, and it's been the integration of my research into decision-making, high-performance leadership, threat and risk as a package. based on what I like to refer to as a VUCA— volatile, uncertain, complex, ambiguous, and digital world. VUCA was originally a term coined by the US Department of Defense in the late 1980s.

Yeah.

But we've moved on from that significantly. So, to directly answer your question, about 2 years into teaching the Psychology of Risk program, I would always ask our graduates who came— and some of them were people at the top of their careers, you know, they were Chief Risk Officers of Australia's largest organisations, Chief Security Information Officers, or in many cases some of them were CEOs and general execs just themselves. I'm like, why are you here? You, you've already made it to the dream job you want. You don't need further education. And the universal answer I kept getting was, we are experts at applying a process, taking a template, taking some regulatory standards and implementing them, but they just don't work very well by themselves. You know, people and From a risk perspective, it's easy. People often— the risk side of it is the handbrake to happiness. These are the people who tell us no. They're the roadblock to our project happening the way we want or to our budget being approved. That's because we mixed up risk and compliance and got that wrong and still mix it up. And we still mix up risk and governance. You know, poor governance is a risk. Risk governance is how we look after the way we manage risk.

Yeah.

They're quite different. And these things, compliance, risk, and governance, always get mixed up and not handled well.

Yeah.

But to directly answer your question, the feedback of my students kept driving more research for us. So, we started looking in 2016 and '17 a lot more at the risk and resilience crossover. To go risk, it hasn't happened yet. And for my fellow risk nerds tuning in, thank you. But the technical definition of risk according to the ISO standards is the effect of uncertainty on objectives. So, to be able to be good at managing risk, we need to be good at managing uncertainty, we need to be good at setting objectives, and we need to be good at understanding how these aspects intersect. So, practically, if we look at how that rolls out, doesn't matter how good you are at risk management, bad stuff will happen from time to time, simply because we can't predict the future.

Yeah.

Equally, you will miss opportunities or miss the ability for your business to do really well if you're not open to those and you're constantly defensive. So risk as only a threat or hazard management piece, it only achieves half of the objective. The other piece should be how do we set us up to grab opportunity and nail our growth plans or our strategic vision? So practically risk and resilience to me are intertwined. Risk, it hasn't happened. Resilience is what I need when a risk gets realised.

So in the—

We'll get to resilience though, don't worry, Dave.

But to sort of play that example out and just thinking, I mean, there's a growing trend at the moment to sort of take a listed ASX business take it into the private market and then potentially on-sell it, you know, list it back on the stock exchange or move it on in another way, with the idea of moving away from the governance, the compliance, the checkboxing, moving to core business strategy, getting on with things, making decisions and not being publicly scrutinised, I guess, to some degree. Boards are developing risk management frameworks or curating their risk appetite. I mean, how do these sort of artifacts in highly governed businesses—

You're making my whole day, mate. So I like to— Where are we going to? We got to keep going. I like to use the term risk theater, right? And it was originally coined by a US researcher, Bruce Schneier, who just after the 9/11 attacks looked at what the TSA were rolling out there and he went, this is all security theater. It's not going to stop a terrorist, it just makes everyone feel better. So a lot of what we do in risk management is risk theatre. We have all these artifacts. In fact, one of, one of the things that drives me insane when we'll do a consulting project is, you know, we'll hear comments like, don't worry, the risk register is up to date.

That's right, the risk register's got that one covered.

And you go, so what? Like, how is that enabling better decision-making, you know, to minimize downside threats and hazards and help you force multiplier upside opportunities. If it's not doing that, then you're just pretending.

Yeah.

And part of the challenge with this, I like to use the term SWAG, scientific wild-ass guess, because anytime we're forecasting the future, we're taking a SWAG. The more science we have, the more likely we are to get an accurate— a more accurate forecast. But realistically, you know, a board sitting around the table determining risk appetite, wonderful. You We have another term we use which we call STACTICAL, strategic and tactical alignment.

That's another word.

Another one. We have trademarked that in Australia. I'm waiting for my US patent to come through on that one too.

Awesome.

But the STACTICAL idea was really formed because we found such a dysfunction between strategy and execution. And I landed up in 2017, I think I did the late Clayton Christensen's course on disruptive innovation through Harvard.

Awesome.

And there were lots of lessons that I took away from that, but chief among those were 2 things. One, very, very few strategic plans are ever implemented, and that's kind of scary. And 2, you can't disrupt yourself. So, you know, a business that wants to disrupt the way it does something has to be very mindful and careful how they do it. So, if you look at both of those ideas going, well, our strategic plan needs to change. If we look, and I'll share even my internal business post-COVID, we plan in 90-day cycles. We have a strategic piece of where we want to get to, but those are much more principle-based. Literally every 30 days, we are redoing our strategy, redoing where we focus, and redoing what we need to do. Sometimes things stay the same, other times they change. But if we had to wait 1 year to update the risk register so we could look at our strategy and figure out if we're tracking, we're already dead in the water.

Yeah.

It's slightly easier for us. We're a, you know, 450-person organization, but that's still big enough to have lots of challenges. So, back to the pre-resilience thing.

Yep.

So, so, what landed up happening was, as we researched resilience, and I landed up picking the brain of so many global experts. I used the team in the US who were hired by the US Department of Energy, who actually used Carnegie Mellon University to develop first resilience architecture for the US energy sector, which became quite a well-known product that's now used open source there. And then I also used a guy in the UK by the name of Tony McGurk, who took the worst performing fire department in the UK and turned it into the best. And I kept asking them, what did you do? And the more we dug into this, the more we realized there's a few challenges. So, I'd love the listeners to think about something.

Mm-hmm.

Depending on your business, So, if you work in a large-scale government department, or if you're in an ASX-listed or a large-scale company, often rewards flow to those who firefight and put problems out, not to those who stop problems from happening. So, if you think about it, if I'm a fire chief, and there are no fires in my region, my reward is I lose budget, I lose manpower, and I lose resources. Much the same in most corporates. If my department hits its goals but doesn't make a big deal, there's no issues. Normally, at best, we'll get to maintain what we have.

Yeah.

So most of our systems were not set up for a fast-paced, agile, VUCA world as we described. They were actually set up for the industrial age manufacturing era, and we're still stuck with that. So, you know, I'd urge a lot of people sitting on boards today to really think about the tools that they use to create their success have to change.

Yeah.

And what worked then won't necessarily work now without tweaks and adjustments. So the first piece was proactive prevention. Within the risk and resilience modelling, there's a lot of talk about that, and we talk about controls and control effectiveness. But what we don't really talk about is how this works in practice compared to having a great compliance architecture, which I've seen many, like some of Australia's top companies have the very best risk frameworks, risk architecture, risk systems, risk software, risk reporting tools. There's lots of pieces, but if you haven't ever heard the term GIGO, garbage in, garbage out, yeah, you know, your system is only as good as what it's used for and the inputs into it. So, in many cases, it's a human problem, okay, because even if we look at AI, and at some point that would have popped up, yeah, the current risk control for AI is that a human must make the call at the end. Yeah, humans are not good at decision-making.

Well, that's true.

So our current control is not a very effective control. In fact, it's the exact same control we use now. Okay, so, so part of the challenge we've got, and I feel this is a very personal mission for me, that I would love to see a suite of skills evolve that made Australia incredibly competitive again. And I'm not saying we're not in all aspects, but we are definitely losing a I think a lot of the leadership pieces that we had in earlier generations, mainly because it's really hard to do business here based on the compliance requirements. And things move slow. To your point, generally people will be risk-averse. You know, if we just look, for example, at the federal government PwC scandal, that's a year and we're only getting feedback on that now. So, we've seen a massive disruption to government consulting through that period.

Mm-hmm.

but it takes its time. So, that doesn't help high-performing business.

Yeah.

So, the first part of the resilience concept was the— how do we address proactive prevention? The second part, which we really saw through COVID, is opportunity centrism. If we can look at risk in a balanced way that's not just about downside threat management, but also about upside opportunity management and innovation, we may actually land up having one or two bad things that happen. So, we haven't managed every downside risk, But we land up catching whatever it is we were hunting for and achieving our objectives to a level that, you know, the one or two things that went wrong were inconsequential.

Hmm.

So, part of the challenge I think we've got today is we need a different system, and that's really where we've landed. That I've found pretty good results running board workshops and executive workshops where we go, let's just think about this instead of the conventional risk maturity models, which tend to look at things like You know, we're trying to figure out what we're doing, to we know what we're doing, to we do it really well, to we're the exemplar. They don't actually measure how much effort we should be putting into our different areas or where our appetite actually should be sitting. So, if you can think about for your business, what from a compliance perspective, what is a non-negotiable? These are the things we have to do. And even there, there should be an appetite statement because generally the more regulated your environment, the less flexibility you've got in compliance. But equally, compliance should extend to your board directors and directives.

Yeah.

And the decisions they make and drive down, as well as your executive decision-making and the structures they put in. Then the resilience piece, uh, one of my massive frustrations at the moment is even post-COVID, we saw the early pieces, but there's this perception that business continuity, business interruption, and that side of it will solve our problems. I'm a big fan of business interruption assessments. I'm a big fan of business continuity processes. But let's just think about it practically for a second. And you run a business, Dave, right? Your business is growing. It's a good business from what I've seen, and you're kicking some goals. Great. It's going where you need it to go. Who says you're not going to get some sort of disruption that's going to hit you guys that if you were just able to think a little bit out of the box, you could turn it into the biggest opportunity you've ever seen? But if your whole mindset is defensive, you're never going to see the opportunity when it comes.

Yeah.

So, you know, it is a hard thing to talk about. I don't think we need to really, you know, be thinking, how do we make risk sexy again? But risk is not new. You know, every time a human's had to make a decision for the entirety of our existence, we've weighed our pros and cons, at least with the System 2 part. So, why have we made it a dis-enabler now as opposed to an enabler.

What's interesting actually, like there's this idea of tall poppy syndrome. And when you were sort of talking before about some of the ways we make decisions and you mentioned sort of at the risk of getting an own goal, we'll forego an offensive goal. I mean, covering your own ass, not being able to make a big decision, um, does that sort of play into this? Like, this— is it litigious? Or, you know, compliance does serve a purpose from a litigious perspective because, you know, we've got a safe work environment and we've got a process and a structure and, you know, we're going above whatever our industry's regulations suggests and therefore we're a good corporate citizen. Um, so that's a style of thinking, and this is very different to what you're sort of, uh, suggesting.

Well, yes and no, Dave. So, so to your point, my perception of this and what I've found with my own businesses— and this is, this is my second run, and, you know, I sold my first one, and we're doing pretty well on this one, even though it's taken significantly longer than I thought. But I had to learn it. I had to learn a whole new operating country.

Fair enough.

But to directly answer your question, we need compliance. Don't get me wrong, because if you look at environments where there's no level of compliance, you have anarchy, and generally you get criminal gangs. Just look at Haiti as an example at the moment. Okay, it's not a good place to do business. Conversely though, we should look at compliance for what it is. It generally happens when something goes wrong so many times that a regulator or government authority has to step in and go, this has gone wrong so many times, we don't want it to go wrong again. So, that should just be good business practice. Honestly, if we're not looking at things that have gone wrong many times and planning for them, that's our failure. Where we need to watch out for the trap, and it's a sexy trap, because if we, if we look at, for example, when I was trained in management, albeit 25 years ago was my first kind of go with it.

Yeah.

I still distinctly remember my professor in front of me lecturing, going, When you build the perfect business system, people are irrelevant because you can just slot them in and out. I've never met anyone who's done that to date. I've been doing this for 30 years. I don't know if you have.

Maybe McDonald's would be the closest where they've taken all the thinking out of—

But let's just think about it too. They've taken all the thinking because their process is highly evolved. What they have done though is built a culture that recruits young people who will work in an environment like that really well. Doesn't require robust decision-making. So, they've enabled it to work. Okay, so they've got a business model that's quite unique. I would say if we look at your business, look at my business, we solve problems and we try and educate and create thought leadership outcomes. We do a bit more, we provide manpower and various other things.

Yeah.

But for us, what worked yesterday might not work tomorrow. So, we need a different way of thinking. So, that's where the stretch from compliance into resilience actually comes. I look at that as actually a separation where we eliminate the hubris and the arrogance of thinking that our system and our process and our compliance is so good that nothing will ever go wrong, or that it's good enough for us to achieve our objectives.

Yeah.

Um, I've done many different things in my career, but one of them, I served as risk expert and peer reviewer to one of the Queensland government director generals for about a $4 billion construction project.

Right.

And it was fascinating for me to sit on the government side, not the contractor side, and actually see what was going on. And they did a really good job. They really did do a good job of getting the best for the, for the government and for the people and managing the risk. It just took a long time, right? A really long time. And people were so busy defending their turf that very often we lost all this time and energy on ego and turf protection instead of how do we get to the objective.

Yeah.

So resilience is an interesting piece, and we can spend a drop of time talking about it because it's the buzzword of the day at the moment.

It is.

During COVID the Global Business Continuity Institute had me do a few keynotes for them. Yeah. And when they were briefing me for the keynotes, they kept saying to me, well, we are technically the experts in resilience. Like, our job when we train people is for them to look at a business, look at a process, and determine what could go wrong and how do you bulletproof that process or that system. They kept saying to me, our people are so confused because who looks after resilience? Is people resilience sitting with HR? Is cyber resilience sitting with the IT team? Financial resilience sitting with the CFO? Operational resilience, where does that sit? So, it's quite interesting that we come up with these terms, but we don't necessarily know how to apply them.

Yep.

Then what happens in organisations is a power play for who gets to control how that term rolls out. And equally, we then get this mix of totally ineffective outcomes or really effective outcomes. So resilience for me is really simple, and this is where we actually have to shift our thinking. So I look at the shift from compliance to resilience as a shift from thinking about only one problem and one level to thinking about multiple levels simultaneously. So the shift is a tactical level then. To actually go from compliance to resilience, we have to be able to entertain the fact that things may go wrong, equally that things may go right? What do we need to force multiply what could go right? And what is the bare minimum? So, that becomes a risk tolerance discussion. So, we actually can't tackle resilience without risk because if we can't measure our tolerance, how do we set our appetite? And there's a bigger discussion around that too. But realistically, resilience is fascinating because researching it now for my latest book, I've been talking to a lot of very smart people. And what's fascinating is that there's a lot of research that's been done that actually shows we can change over time. But some of us are just more fragile than others. Some get triggered more easily than others, and some have more inbuilt resilience. Okay, the guesstimate for that is that roughly 1 out of 5 will be more fragile.

Right.

Where 4 out of 5— and this was done primarily with kids, the initial research, but it translates into adulthood. The challenge we've got at the moment is we're designing a ton of our systems for the 1 out of 5. We're modifying lots of things to address that. Think about work from home as an example. Extroverts struggle to work from home, introverts love it. Okay, self-motivated people with an intrinsic— so the self-motivated driver— do really well at home. Extrinsic people who want rewards and pats on the back do terribly.

Hmm.

Okay, so, so one of the big challenges we've got is that compliance does not drive human centricity. When you shift to resilience, we actually have a shift into where does the human fit in this? And when we can understand where the human fits in it, we can then start to stretch. Only when you kind of get the right pieces of compliance and resilience working can you even start thinking of how resilience works in, where proactive prevention, opportunity centrism come in. So it's like a 3-legged stool to get it right.

And I think you, you were mentioning in the pre-briefing call that you've you've got the rights to that word as well, Presilience.

We have trademarked it and patented it in most English-speaking countries, but I would strongly suggest that if you want to use it, just use it right and just reference us. Yeah, I really feel this is more of a professional driver than a marketing business opportunity, and I would just love to see more proactive decision-making around prevention. Yeah, and risk not just being viewed as the handbrake to happiness and, you know, the negative side of it, but also the opportunity side and the innovation side. You know, if you're sitting on a board or an executive and you've got to build a strategy and your risk people are not there, you're tying your hands behind your back. Yeah, because the very few— the very people who are trained to be able to help you figure out what could work or what couldn't are often brought in after the fact as a tick-the-box piece as opposed to an enabler.

Well, that's interesting. You say sort of risk people, and you mentioned before around, you know, the power play of the term resilience and how it's being brought into a business, and you went through various functions. Is it a centralized— and we've got a— we're fortunate to have a couple of chief risk officers as part of our community, so I'd be interested in your view around whether risk is inherent in every part of the business or whether it is a centralized job or practice.

So let's run a little activity just to align that. So if the idea of risk is the effect of uncertainty on objectives, how we manage the effect of uncertainty on objectives through enabling great decision-making aligned to our strategic objectives, right? So if we look at what a good risk management system does, it should enable the right decision-making to occur with the maximum frequency.

Yeah.

Okay, just checking, you, you with me?

Yep.

So, so if that's the case then, and we're actually looking at how do we do that, there's not a one-size-fits-all approach. So often clients come to us and they go, what is the perfect structure? And we go, what do you want to achieve? Who do you have working for you? What are your timeframe pressures? Who are your competitors? Without that knowledge, how do you actually build the right structure? So, in a— and there's 2 variables that we should think about. The first is control. The second one is certainty.

Right.

So, if you have a high degree of control and a high degree of certainty, then the most managerialism-type-centric tools work quite well. Command and control works quite well. For those who are listening in who are briefed up or trained up in complex adaptive systems theory or systems theory, you know, we tend to focus then on simple and complicated systems modeling. which is we have a high degree of control, high degree of certainty.

So that'd be a centralized kind of approach?

So, a high degree of control, high degree of certainty, it's much easier to set up systems that are run— they kind of play as they, they should. They are, they are continuous and they work quite well without the need for much adjustment, tinkering, or adaption.

Yeah.

If you move to the next side of the equation where we look at complexity, which, you know, just Google CAS theory or complex adaptive systems theory, you'll see how much work has been done on this space. Most of the tools that work when we have high degrees of control or high degrees of certainty don't work when you, when you flip that switch. Yet we keep seeing people trying to use the same tools they use for simple and complicated to manage complex and chaotic.

Right.

Okay, which is the other state. So you've got to determine what type of business you have. If your business is, for example, a plotting business, which is highly structured, highly regimental. And I'll give you an example of that. We do a lot of work in the mining sector. So, mining technically is a highly process-driven environment. What makes it difficult is that they are reliant on external variables like the humans rocking up to the site, being motivated to do work at the output they want them to do it at, commodity prices being at the level they want them to be, and control of their supply chain and distribution channels. So when you actually look at it, you go, yeah, there is a lot of certainty and control on your site. There's not a lot of certainty and control for the variables outside your site.

Yeah.

So as a result of that, you actually need what we refer to as an ambidextrous system, a system that has both capabilities.

Yeah.

What the real truth of it is, it does depend on the animal you put in charge of this stuff. So in a smaller business, this should be a chief executive's job. So, if you're in a 300 to 400 person business, you probably don't need a dedicated Chief Risk Officer, but the Chief Executive, the Chief Operating Officer should be highly trained in risk management.

Yeah.

If you're in a slightly bigger business, then we start looking at, you know, what we could refer to as siloed thinking. So, workplace health and safety needs its own manager, for example. If we're in finance, maybe the credit risk team needs, you know, their own risk manager. And so, the list goes on and creeps, and we can find, you know, particularly in some of the financial services sectors, there's all these different risk divisions.

Yeah.

That are tackling— one's tackling credit risk, one's managing product risk, one's managing risk compliance. The list just goes on and on. It's actually quite insane that we've got all of that expenditure and effort. And the biggest challenge with that is most of that, in my opinion, is risk theater. We're just pretending we're managing risk, but in actual fact, we're just keeping regulators happy.

Yeah.

So, long story, short story, it's a human problem and it's also a human opportunity. So, if you've got the right person who understands risk management at a strategic level, I believe we're actually in a state now where we need integration. The gaps exist between the silos. And I saw that so clearly when Risk2Solution was formed nearly 14 years ago, was when it started, but in 2013 when we formed the business, It was primarily formed because I wanted to sell security, safety, and emergency management as a package, and I couldn't.

Yeah.

They all had different reporting lines in the different clients, and I kept thinking to myself, there is a place for that, but hold on a second. If your security person is saying, that's not my problem, that's a safety problem, and if the safety person is going, that's not my problem, it's an emergency manager's problem, and if the emergency manager is going, um, no, I don't want to deal with that, I think you should go back to the other 2, who's solving your problem. So, we see this handballing all the time. We also see numbers and stats manipulated tremendously. So, I'll give you an example. Often, we'll have clients who come to us and go, we've just implemented a new reporting system and, you know, our safety metrics have gone all haywire. We're getting all these reports coming in, you know, we're in trouble. My normal response is, no, you're not. All the stuff was happening before, you just didn't know about it. Right, you're in a significantly better position now because at least you know about what's going on. Yeah, so we've also got to kind of change the mindset of the way a lot of executives think, which is, you know, you don't want to be told it's always all right. You actually want to be able to understand where it's not all right and where there's opportunities for improvement, which is a culture thing.

Yep. So do you think we're, um, you know, we were fortunate to have John Polias in Brisbane recently with his He gave us a bit of an example.

Love that guy.

Oh, amazing. Um, he gave us a bit of an example around how we as Australian businesses and employee-employer sort of relationship is more of an influential style leadership, um, because the— versus maybe a hierarchical one that you might see in, you know, Southeast Asia or something like that. So in terms of risk, does that set us up well, or is that more challenging or more creative that we need to be?

It's really interesting. So I'll put my academic hat on for a second, and as any good risk person will tell you, you can't provide advice without good context. So the context piece is a challenge, but let's just look at Australia, okay? And actually, one of the entities we acquired a while ago is the Australian Security Research Centre, and I touched base with the guy who actually set that up in 2005, and we haven't done it recently, but he used to pump out a strategic risk assessment for Australia every year, right, which I thought was pretty cool.

Yeah.

I also chair the Institute for Strategic Risk Management for Australia, New Zealand, so I thought that would be a fun intersection.

A magazine of all this stuff that could go wrong, effectively.

Well, all right, all right. So that's, that's the trick, right? It's not, it's not a binary thing anymore, right? We need to look at it holistically.

Yeah.

But directly looking at that piece in terms of the Australian environment, I, I don't think we can say generically Australia is well placed or bad placed. It's a tough place to be an innovative business for sure. The barriers to entry are incredible. I was explaining this to a colleague of mine who's just kicking off a startup business, and he called me a few weeks ago. He's going, I've got it, it's time. And I started explaining to him, I think I'm on probably the 10th startup business in Australia so far, and about 3 or 4 of them have worked well, but the majority haven't. That's right.

Is this person in Australia?

Yes.

You're inviting?

Yep, yep, yep. And, uh, I, uh, I sort of said to him, well, have you got about 400 grand? And he goes, oh, I can't start my business, you know, I don't have that amount of money to kick it off. I'm like, well, if you just look at the insurance you're going to need to kick this off, the accountants and legal support you're going to need to kick this off, the licenses you're going to need to trade, you're going to need 150 grand for year 1 just to tick your compliance boxes. That's before you operate, right? So if you look at the barriers to entry The actual system doesn't equate with the reality of what we have to do.

Yeah.

So, from an entrepreneurial position, incredibly tough. From a larger business perspective, Australia spits out incredible talent. Incredible. I mean, some of the people that you see leading some of our businesses are the best in the world. I would say that happens despite the system, not because of the system. And generally, you'll find people like that have worked extensively overseas. And they've taken the best of their overseas experience, the best of the Australian experience, and they've bought something quite unique that's a bit different.

Yeah.

So to be honest, I am really worried. Noting, I guess, the listenership, I love studying and I'm always studying. So I recently did my ARCD program.

Oh, so you're ready. You're ready to go out in the big bad world.

I've been a fellow of the Governance Institute probably for about 10 years, and I sat on their educational committee. So I played with that side of it.

Yeah.

And I'm busy restructuring my business, which will see me sit as the chair.

Right.

So I thought, okay, I better get the tick. And while some of the content was wonderful, a lot of the content is, is not actually workable in the current environment, which happens to move so quickly. So we're actually training our people with the wrong skill sets based on outdated thinking. It's nobody's fault, but stuff moves too quickly.

Yeah.

So, to your earlier point, if you look at any sort of tech, let's take the most basic thing. Let's take email. Everyone uses it in the business world every day. Just visualize it for me for a second. If you're listening to the podcast, same with you, Dave. Think of all those tabs on top of your emails that can do millions of things that most of us never bother to maneuver with because we don't want to break stuff or we think they're irrelevant. In the last 20 years, technology has moved so fast. faster than humans are actually able to keep up. So we've actually got a significant deficit right now where even though AI has kicked in and all these wonderful things are happening, it's why cybersecurity is such a challenge at the moment. It shouldn't be. It's just another risk variable.

Hmm.

And it's another risk that's happening in a virtual domain, which is what freaks everyone out because we don't understand the virtual domain. But practically, the challenge we've got is we're 20 years too late in human development. We actually needed to be training our people in a different skill set to what we've trained them in to date. So, we're still stuck in the mindset of, I train you for the job I want you to do, not I train you to solve problems in a fast-paced changing world.

Hmm.

They are very different things. So, our research sort of showed us there's about 6 or 7 skill sets we need: situational awareness, critical thinking, decision-making, effective and directive communication, the ability to act or, or not act. And, and often when we train people, I talk about mindful inaction. It's okay not to do something, but this goes back to your earlier question. If I'm not going to do something, well, I'm not going to make a decision, do I have a window of time and the ability for me to not make that decision that's not going to make this a lot worse? Because if we look at almost every review of a disaster or crisis, failure for leadership to make decisions compounds what they're facing when they're under pressure. And often you'll see people who are incredibly good at decision-making actually just go, all right, I'm not sure what to do, but let's start with this. And there's a lot of science that supports how that works.

Yes.

I can explain that to you later. But directly to answer your question, I, I think we're in a fascinating place at the moment where we've got to train those skill sets. So after inaction and action, we then get the idea for learning and reflection. And those should be skills. So often organizations talk about those as soft skills. I think they're core skills. And this is the shift. We need to stop training people only for the technical job we want them to do, and we need to train them to be highly adaptive, agile, and resilient so that they can learn to do lots of jobs through their career and be incredibly useful for us. And often I'll have clients of mine, particularly when we sell this stuff at a corporate level, So, well, I don't want to train them to do stuff I'm not going to use them for. And then you ask the question of going, well, what is your business going to be doing in 3 years? Will it be doing exactly what it's doing now in the same way? And most of them will pause for a second and they'll go, probably not. Particularly those who are looking at AI, cyber, etc.

But will that person have moved on in 3 years given the tenure's sort of coming? Are we paying it forward for the other company and hopefully the other company's paying it forward for us?

You know that old Richard— I think it was a Richard Branson saying, you know, What happens if we spend all this money training our people and they leave? Well, what happens if you spend all the money training your people and they don't leave?

That's true.

So, so I actually think we've got to have a bigger picture thinking piece with us, and we've actually got to go— I'm honestly, I'm super happy when I have a staff member who feels they need a different experience than I can give them through my businesses. And almost always when that happens, I will try and find them their next job. Because what's the point of keeping people in a confined environment where they, they can't grow, they can't evolve, and they hate what they do?

Yeah.

All you do is get poor performance. So, we need to integrate risk and performance as 2 key drivers, and the link between those is actually leadership. And it's fascinating, you know, let's— I mentioned to you in our preamble that I was over in the US not too long ago and very excited about the opportunity for expansion there, but not, not to make this political, but if, if in a country of 330 million plus we have to have a Biden-Trump rematch, like, where's the leadership?

Hmm.

Like, where do we see this happening? So the challenge we've got now is in our existing environments, and we spoke about a strategic risk assessment. Let's just look at Australia for a second. Australia is a socialistic capitalistic democracy. If you take those 3 words and you wonder why it's so hard for our society to be cohesive, For business to balance with unions, for unions to back business, for employers and employees. You mentioned John earlier and that matrix of command and control in certain Asian countries versus what we have. We've selected a bunch of really hard things to integrate.

We have.

So if capitalism was more of a driver, we'd probably see more US-type behavior.

Yeah.

You know, if socialism was a stronger driver, we'd see more dictatorial kind of Chinese-type behavior.

Yeah. Which we saw a little bit of that. 100%.

And, you know, we're sitting in Melbourne, COVID is not long ago.

Yeah.

So, the challenge we've got is our current operating environment is a difficult one, and the way we've selected to run our country is a difficult one. So, from my perspective, the shift from resilience to pre-resilience is actually a shift from 2-layered thinking. So, you move from tactical and strategic to 4-layered thinking, where we start looking at me, the The self, all right, how do I make decisions? What do I do? What are my ethical drivers? We then shift to others, you know, how do I motivate, lead, or inspire? Or how do I follow at the appropriate time? Organizationally, you know, what do we do within our organizations to make sure we can align great outcomes?

Yeah.

And the last one is societal. So, we determined pretty early on in our game, we're not a government department, we're not a policy-setting organization. So, the way for us to have societal impact is to start with the first 3, self, others, and organization.

Yep.

And that's a lot of what we've built in our training programs. So for example, every one of my managers has to go through our internal resilience leadership and high performance training. It's not that a lot of them don't know the methodology, it's I want to see you do this stuff in practice, and I don't want you to be able to go, nobody's ever taught this to me or showed this to me. And you know, it's fast— that, that part is fascinating because as as we discussed during the preamble, we were able to 10x in year 1 post-COVID, and we've almost doubled again this year.

Yeah.

Yes, it's a ton of work over 10 years or so to get there, but really what is changing the game for us and enabling us to take on these really big, hairy, audacious goals and opportunities— because almost all of my advisors, when we had the chance to go from 30 people to 150 people, we had to do it in 3 months. Went, no, that'll sink you guys. Like, it's too big. We took that on and then we doubled again. And my secret sauce has been human centricity through this resilience piece. It's not about constantly making people happy because that's, that's also a recipe for disaster because happiness doesn't equal outputs.

Yeah.

Happiness is also fleeting. I've been training my people on these pieces, how to be situationally aware, how to critically think, how to make great decisions, how to act on those great decisions, how to keep learning and reflecting, and how to drive better comms. through the process.

I'm just writing down your secret sauce.

If you come and do one of our courses, I'll give them to you.

Okay, done.

Um, but realistically, that, that then comes to the challenge of how do we define each of those things. So, um, one of my, my first book was on bodyguarding, which only people who want to be bodyguards would ever read. Yeah, so very small sale. Second one was on situational awareness, primarily on a security perspective. So I would urge people, if you're feeling concerned post, you know, Bondi-type attacks and those sort of things, pick that book up. Because one of the best things about running an academic program is you can tell people what to read. At that point, we had a contract with DFAT. We were training every diplomatic staff member that was going overseas, received a day of personal security awareness training with us.

There's clear cues with like asocial behavior.

And 100%. So, so that, to your point, what's fascinating on the situational awareness piece is our own siloing makes it ineffective. Because just think about this, and those, those who are in big organizations, I'd love you to go back to your organizations and have a look at how you tackle this stuff. So for anti-money laundering, there'll be a training program. For bribery and corruption, there'll be a training program. For privacy, there'll be a training program. For cyber, there'll be a training program. For workplace violence, there might be a tra— the list just goes on. I can guarantee you, because I've spent almost a decade researching it, that when you dig down to the core skills of any risk area, they are the ones I just gave you.

Right.

And we've missed the boat. What we should be doing is training the holistic skills and then just giving knowledge. So if somebody knows how to be situationally aware, we just need to tell them what to look for for each threat. We don't have to teach them how to do the thing.

Yeah.

So what we end up doing is teaching them over and over again how to be situationally aware for each context. So all we do is switch them off because think about this. You're a busy guy. Okay, I've seen. I've tried to track you down. How many emails do you get a day?

A couple hundred.

Couple hundred on a slow day. Okay, I think you're probably being humble. Phone calls, text messages, social media.

Yeah, yeah. Another couple hundred all in them.

All right, let's just take a minute per email, per social media message. Your day is gone, right? That's without you thinking of a strategy of how you're going to grow your business, what fires you need to put out in your business. Okay, and how do you need to implement the processes and the plan you've already established?

Yeah.

We don't have time anymore. So, I think there's a few trends that have to come back we need to think about. The first one is the concept of integrated risk management, where one set of tools can solve multiple risks for us and address multiple risks. So, it goes back to the resilience argument that you do not need business continuity planning for every part of your business. You need them for the critical risks that will destroy your business, And then we need enough flexibility and agility to go, well, if it's not a risk that fits into one of those 10— should never be more than 10 categories.

Yeah.

My people are agile, resilient, pre-resilient, whatever you want to call it, doesn't matter. We can tackle it because we've got great human capability and a framework to deal with uncertainty.

Yeah.

Which that might be an incident management framework, a crisis management framework, either of those work. Crisis management really should be built as an uncertainty tool, not a compliance tool. If I look at a lot of our clients, we run an exercising division. A lot of our clients, they just want to tick a box. We will actually— thank goodness my business has gotten big enough now we can turn down work and it doesn't hurt us so much. And I'm turning down work when we've got clients who just want to tick a box. Go to one of the Big 4 consulting firms or someone else, because if you just want to tick the box, I'm carrying your liability when something goes wrong. I'd much rather go, this is a partnership, how do we grow, which is a different story. So, if you think about how busy you are, critical risk management, in other words, the key things that will undo your business, are the primary focus area, and then integrated risk management around how many things you could put in. So, this is also where risk leadership and high performance intersect.

Hmm.

If I'm good at decision-making, which is the risk part, if I'm good at critical thinking, that's the analysis part, then I need to be looking at people who are good at implementation, which is the action and the learning parts, the comms parts. So, you know, I think we've got to change our view fundamentally and go, not everybody is going to be able to grow all these skills. I'm not naive enough to think everybody has the perfect formula or matrix to do it.

Yeah.

But in larger organizations, let's even take System 1 and System 2. If your risk team is only made up of System 2 people, which many of them are, Actuaries, data analysts, compliance people. Exactly right. Then they get very frustrated because they think every single problem or opportunity requires a full risk management suite. We don't have time for that.

And do you find, like, in that space, I know when you're sort of looking at something and you— when we critique something, we come up with 10, 20, 30, 100 critiques about something which may have, you know, improvement connotations or negativity around it. Could have done this better, could have done that better, you know. Then we look at, okay, well, what went well? And we might get 5 or 6, maybe 10 if we really stretched it. Um, does, does that just organically play out in, you know, the management of risk? If we're looking at the management of risk, obviously it's what's going to kill me, what's going to hurt me But what's on the other side? It's like, well, business is all about risk. It's a dynamic scenario. So how do we—

Well, just listening to you, my work is done. You got it. Okay, great. But to directly answer your question, this is where human centricity and human understanding is so important. So we need to understand how we evolved as humans. So just think about what you said, how quickly bad news spreads, or how easy it is to identify negative trends compared to positive trends. That's, that's a survival instinct, right? Humans were wired to look at what could hurt us first.

Yeah.

And there's a part of the very, very small part of the brain called the reticular activating system which filters everything that comes into our senses. It filters it on only 2 variables: what's of interest to us or what could hurt us.

Yeah.

So if you think about most risk-type programs, whether it's safety, whether it's psychosocial risk, whether it's cyber, they tend to only hit the people who have felt pain already so they can relate to it, or the people who have interest. Look at the majority of your work population. They are usually people that have no interest and haven't felt the pain.

Yeah.

So that's part of what's happening in Australia today. If we look at the challenges we've got with social cohesion, if we look at some of the challenges we've got with increasing antisocial behavior, aggression, and violence— I run occupational violence and aggression practice, so it's good for my business. Yeah. We're seeing these trends continue to increase. It's not a surprise because we have not built a robust, resilient culture. What we've done is we've built a compliance-driven culture that people want to wait to be told what to do. If they don't like what they've been told what to do, they have mechanisms to protest or to counter it, or they just don't do it. Okay, which is really interesting because even when they don't do it, they still don't do it within rules. Even if you look at our COVID responses, the vast majority of people complied. The vast majority, right? You really had to push a few people too far for them to not comply. You had some risk-takers who might have gone, hey, if it's a 5-kilometer kind of boundary, maybe I can do 5.5, where your appetite may be set. But realistically, the challenges that are coming down the pathway for us are things we've never dealt with before. It's not going to necessarily be a COVID, it's not going to be, you know, a fraud thing, it's not going to just be some guy going crazy in Bondi and it's stabbing people. Don't get me wrong, those things will keep happening. I, I'll put money on the table right now, we will continue to see a spate of all of that stuff. The bigger challenge is what does happen geopolitically if the US goes to war with China? Just an example, you know. What does happen if our universities actually get overrun by protesters and we can't get educational outcomes?

That's right, you know. So, so trade sanctions on China, what does that mean for us? Like 100%.

So the challenge we've got now is complexity actually is the default. We want to go back to simple and complicated because it's much easier. We have certainty and control. So the challenge we've got is equal to probably anything our ancestors have ever faced before us, and then some. Never before have humans faced what we face. We're hyperconnected. We share information at literally the speed of light. We have no idea if that information we're sharing is accurate or not. And more and more, you know, in fact, I was having this chat with my daughter who's 11 years old, and we were having a discussion around how could it be in the modern world that we still have flat earthers, you know, people that actually believe the world is flat. And she looked at me and she's like, well, in geography, I just learned all this stuff 4 or 5 years ago, so how could people even believe that?

Hmm.

And I sent her to do a bit of homework, and she came back to me, she went, there are crazy people that believe that. That makes the challenge harder. So I think part of what we've got to do— and this is an interesting segue, and we could probably do another whole podcast on this—

Flat Earthers is the next one.

Oh man, moronism and decision-making in practice. Because, you know, for people to double down on that sort of thinking, you've really got to go there's some sort of psychological—

Fascinating to try and break into that. How does that— how does— how do they get themselves into that?

And it's really interesting because if we actually look at what's going on in the world today, social media drives that tremendously. The algorithms, when you go to any search engine, will reiterate and reinforce what you're thinking. Yeah, you surround yourself with a group that agrees with you, and if you don't separate from that group for any other reason than to tell other groups they're wrong You just double down on your belief.

Yeah.

So, part of the challenge we've got at the moment is this— it's a fascinating first world challenge— is we're now hyper-connected, so hyper-connected that people can share ideas regardless of what governments want. Okay, that includes business too. So, regardless of what you want your employees to think, they will think whatever they want to think. So, that's one fundamental shift that's happened in the last 15 years that we never had to deal with before. Okay, historically, If you think about— I mean, when I started my bodyguard career, we still had pagers and we used fax machines.

Yeah.

So yeah, but a little bit— I think we have similar tenure. But think about it, nobody— no mobile phones, so nobody could stalk you, find you after hours. No emails. Okay, so you waited till the next day to go in and check the fax machine. You waited for letters to arrive in the mail. You waited for the phone calls. We had time to think. An important part of training System 1 is a process I refer to as incubation. You actually need to let data and information sit in your subconscious long enough for neural linkages to be made with data that's already there for you to be able to come up with good decisions. So, you know that old saying, take a breath or sleep on it or any of those? They're actually good advice for better decision-making.

Yeah.

We don't have that anymore because the second you get home, you— the emails are piling up, the messages are piling up, the social media stuff's piling up. Yeah, so it's much harder than it's ever been. So the way I see us being able to solve that problem is training core skills and actually shifting the way we think about things into this integrated model of compliance, resilience, and presilience to get high performance working. The secret sauce there— leadership. Yeah, it's the hard part.

Well, I think that's a great word to, uh, to end sort of the open conversation part of the show. Gavin, I think we might have to get you back on the show 'cause I feel like there's a lot more to cover and we could certainly keep going. But what I'm gonna do is we're gonna flick into maybe some short answer questions. So you've actually mentioned a couple of quotes and a couple of novelists as well with Clayton Christensen, who I didn't know had a course at Harvard as well. So favorite quote or a quote that sort of stuck with you that you'd like to share with the listeners?

It changes all the time, but, uh, at the moment I actually really like Michael Jordan's quote on his greatest skill set was being coachable. There are so many great ones out there, but I was— as I mentioned, I'm working on a new book and I was looking for a quote on being coachable. And if Michael Jordan at his level of performance goes, that's my greatest attribute, we kind of got to be more open to feedback and learning.

Yeah. Oh, he's got a— that Netflix series certainly gives you a behind the scenes into his relentless dedication and influence in that team success. Unbelievable. And yeah, and what a— he was almost coach as well based on that backstory. But no, great, great quote.

Can I give you one more?

Yes, yes, go for it.

So my martial arts grandmaster, Gabor Novák, Denis Hanovi, is 87 now, still on the mat, still teaching. And I, I had the gift of being a living student of his. So, you know, basically I just had the shit kicked out of me for an extended period of time on the mat and off.

In his prime.

100%. I mean, the stories are aplenty from, you know, getting choked out on the kitchen floor, and there are lots of pieces. But he— one of the things that, that I always remembered early on, he had 2 of his senior grades who basically betrayed him and set up a competitor school. So these were 2 guys, I think they were in their 30s, and they started training with him when they were 4.

Right.

So you've got 26 years of history. And I remember looking at him, I was probably 18 or 19 at the time, and I looked at him and I was, on his behalf, I was gutted. It's like the betrayal. And he looked at me and he looked at me, you know, almost nonplussed. He said, you've got to be bigger than it. And, and I think that's one of those things very often, you know, when, when leaders say to me, I don't want to spend the money on making my people better through core skills training.

Why?

What are you scared of? You have to be bigger than it. You know, when people make decisions you don't like, what kind of leader are you? If you can't be bigger than it, then you're letting your circumstances dictate your responses and you're not actually in control, which means you're not leading, you're following. Yeah, so you shouldn't be in the position in the first place.

I like it. Thank you for sharing that. We'll get these up, uh, up on the site. But, um, next question, and you've alluded to a book in the makings, but Is there a book you'd recommend reading? And maybe you want to elaborate a little bit more on, uh, your next book. Thanks.

Yeah, I mean, I would suggest, obviously with a bit of bias in this, my reading list is really long. There's a ton of those more businessy risk type ones. But if you are, or you worry about your family's safety, your safety in this kind of fast-paced world, the Can I See Your Hands book that I wrote in the last run is a really good option. for a quick knowledge download of what to do on a personal level. The book I'm working on now, which at this stage the working title is Resilience: Mastering the Art of Risk Management— I'd love to make that more colloquial, but I don't think the publishers will let me do something like Stop Being a Dumbass.

Yeah.

Or something like that. But I'm trying to write a book that will enable both laymen and professionals to get something out of it.

Yeah.

And I'm focusing that one also a little bit more on the personal level. So that should be out later this year or early next year.

Fantastic. No, and good on you because, um, I mean, as obvious males, it's, um, I, I found it fascinating— well, not fascinating or alarming. I was at a conference once and they sort of, you know, put your hand up if you've had physical threat to your life. And then there was another question, Have you had a perception of physical threat? And there was a clear delineation between the men that put their hands down and the remaining arms that were up with women. And so I'd never really appreciated just how, yeah, I guess that how prevalent that is even living in modern cities like this.

Well, to your point, I mean, I've taught martial arts since I was 14. So it's been a while.

Yeah.

I've probably in my own right trained at least 150,000 people in the years that have gone on. I mean, for one of the largest banks, global emerging market banks, Standard Bank, we trained 23,000 people just for them.

Wow.

I've taught thousands of women self-defense. I've trained thousands of instructors who've taught more people.

Yeah.

And I actually believe fundamentally that the ability to protect yourself should be a human right and life skill. And part of the challenge is Australia is wonderful in so many ways. Saltwater insulation and our natural borders have kept us safe for a long time. But just look at the domestic violence epidemic that's going on around us. Yeah, we're not going to solve that problem by pretending it's not there. We're going to solve the problem by owning it and teaching people to say no and teaching people to be able to spot those early warning signs and removing themselves early. It's actually not necessarily around beating a baddie. Yeah, it's around how to keep myself safe ahead of time. So to your point, it's, it's a massive challenge. And, you know, the world we're in now, in so many ways, it's better than it ever was. You know, we've got more equality, we've got more fairness.

For the listeners that are out there, I, I didn't know you offered that course. So I did something similar in the States by a gentleman whose name escapes me. He wrote a book, When Violence Is the Answer. And so Um, I found that just, you know, it's not really a topic area you'd ever want to have to activate, but just knowing how to— what to target.

Is that Rory Miller? Oh, either way.

Yeah, I can't— I don't think so. Um, possibly when violence is the answer, but I'll look him up. I'll link to it in the show notes. But, um, yeah, I wanted to get my, my daughter and wife to do that course as well, but you might save me the international fare. I'll send them up to Brizzy to see you.

And there's people down here that run programs like that. You know, I think the real trick with this stuff is we're still animals, right?

That's right.

And I think as we get civilized, we forget the fact, you know, Abraham Maslow's basic hierarchy— when things go wrong, it's our physiological and safety needs that are the ones that see us undone. And for example, during COVID it was the threat to that that created so much stress. And we, we're not sophisticated animals. Like, we still respond the same way to any threat as our ancestors did thousands of years ago. We fight, flight, freeze, or panic.

Yeah.

So we've got a lot of work to do to undo that component. It's fascinating if we do it right. I think, I think our generation at the moment, so the leaders in play right now, we've got a huge responsibility because if we do it right, our kids are probably going to inherit a world that's significantly better than it is now. We do it wrong, I truly worry about the diverse, the diversive nature of where we're going and the softness of the generations that are coming after us. So you've got a kind of a more divided world with more complex problems with people who are not as robust or resilient. It's not a good outcome. We can fix it, we really can, but it takes a significant amount of forethought, effort, and energy to do that.

Yeah, yeah, fantastic. Okay, last, um, last short, short answer question. I'm loving these short answer questions because there's so much to dig into.

They've all been long answers, sorry, sorry.

No, it's good. Um, so this is an interesting one. Any advice you'd give your younger self?

Plenty, but probably the main one is that it is a journey. And, you know, if I look at my career at 23 when I started my first company, like, I thought I would sell out and, you know, be set at 30. While certainly financially I've got to the point where my businesses are rewarding and I'm living a lifestyle that I'm very happy with, Congratulations. Thank you.

You're in the minority of businesses.

25 years of pain and much failure and lots of heartache there.

Yeah.

But I think the hardest part with that too is if you understand it is a journey, it gets a little bit easier for you to look at the bigger picture and go, okay, I didn't win that contract, now it's not the end of the world. What do I change? What do I improve? So I think in the early parts of my career, 20, you know, aggressive martial arts male in my 20s, the fight instinct was the driver, and I would be incredibly hard primarily on myself. Okay, as I've sort of matured, I think that doesn't help. You know, there's that line where extreme ownership is useful, but equally you've got to be able to forgive yourself and cut yourself a bit of slack.

Hmm.

I haven't done very well with that in the early part of my career. I think I'm doing a little better, but not necessarily an area I've mastered just yet.

Great. Well, it's always, always time, and as you say, it is a journey. So give yourself a break. I think you're doing pretty well.

Thanks, Dave.

All right, so we're moving into rapid fire now, but just before I do, Gav, I know I've asked you lots of questions. We've covered a lot of ground, and I think there's a second recording in this. Was there something that I didn't ask you today that you thought, ah, I just wanted to share that, or is there a closing remark on sort of the big conversation that we've had today?

Many, but the one piece we didn't go into is a concept I like to refer to as risk intelligence, right? So much like emotional intelligence or your conventional IQ, we came up with a whole definition suite for RIQ, risk intelligence quotient.

Have you trademarked that as well?

No, we haven't.

No, because we better be quick.

I'm keen to share, but realistically, we should be growing our risk intelligence. which is the ability for us to take the right risks, avoid the hazards or threats that will stop us from achieving our objectives, minimize the negative consequences. So the definition I have for risk intelligence is it's an applied attribute and living skill that enables you to seize upside opportunity while you manage downside potential.

Good. Just for people that are listening audio-wise, you haven't had any notes in this session. You've been able to— I mean, you clearly live and breathe and know You know this stuff, Gav.

Well, to your point, like, most of what I've become— and this circles all the way back to where we started the question— I've been fortunate and unfortunate from time to time. Like, I've grown up in a very, uh, complex environment. I mean, for the first 15 years of my life, there were gunshots every night going to sleep. Yeah, I've had family members killed in violence. I've spent time in very violent places. My close protection career, I've landed up, you know, looking after people like the President of Equatorial Guinea in West Africa. I've done things not many people can do. And at the same time, I've run businesses in multiple locations. And I've, you know, it's really interesting if you want a good read, David Epstein's book on Range.

Yeah.

Was quite a good read. Adam Grant's also written a bit on how, you know, we should look at people that don't necessarily fit into the mould to solve our problems.

Yep.

But for many years, I kind of thought I was insane. You know, one of the drivers for me was always, I want to be among the best. I never felt I needed to be the best, but academically, I was like, okay, until I get a doctorate, I'm probably not among the best. Martial arts-wise, until I get, you know, to a 7th or 8th degree black belt, I'm probably not among the best. Even martial arts competition, I didn't have to win everything, but I needed to know I could do it. And it's been the same in business. That it's, it's never been the driver to only make profit. It's been a driver to run a really good business where my people enjoy working there, our clients love us, and we produce great outputs. So, I think, you know, my journey has really been this idea of not how much I can do for me. And it's, it's kind of weird that people often look at people like you and I who own businesses, run businesses, and they go, oh, you guys, it's all about you. In 1998, and this is the anecdote I'll leave the listeners with, I was martial arts full contact champion in the style of jiu-jitsu I trained, professional bodyguard, probably at the top of my game. I got a phone call, it was my mother. This was back in South Africa. She was on the way to hospital after my stepfather had been shot in the head in an attempted carjacking.

Wow.

I grabbed my go bag then as a bodyguard. For those who are not familiar, go bag has everything you need to get you out of trouble. That has a significantly different pack when you're a protector, so it's got ammunition, first aid gear, blah blah blah. Yeah, rushed to the scene, got there, there were 2 guys looting the car. Drew my firearm, I had it on them, depressed the trigger, I almost shot both of them. They were both police officers who were looting the car.

Right.

But it was a fundamental turning point for me because at that point, the— as I mentioned earlier, carjack avoidance was one of the biggest selling programs we had. I did not train my family, and that's been a life lesson for me continuously. It does not matter how good the expert is if they're not there when you need them?

Yeah.

How do we perpetuate the knowledge? And I'm finding as I'm getting older now, one of my fundamental drivers is, is not just, you know, can we monetize this, have a great product suite and grow another business division? How do we make stuff better? How do we perpetuate the knowledge? And, and I would— I think that's one of the wonderful things your business does. It's not just about, you know, is this a place that high-performing people can come for coaching? It's how do you perpetuate the knowledge of those who've gone before to help those who are coming now. It's a wonderful gift that we've all got a lot of work to do. And it's such a driver for me. One more saying while we're at it, but one of my martial arts coaches always used to say to me, you never judge a master by his number of students or her number of students. You judge them by how many masters they've produced.

Right.

And, and, you know, back to the point of when a staff member leaves me, for example, if that's their journey to mastership or to master a skill set, with my blessing, I should be helping them on that journey. So, it's a different way of looking at the world, but doesn't mean I don't have an ego, doesn't mean I don't want great things. But I really am driven at this stage to go perpetuate the knowledge, make it better. How do we enable people to do this stuff better?

Hmm.

So, that whole resilience thing for me was I just kept looking at conventional risk management going, it doesn't work well. It works very well in high control, high certainty environments, and it barely works in others. Let's do better.

Yeah.

And, you know, I think that's, that's a, that's a good driver for all of us to be thinking about.

Well, fantastic way to sort of to wrap us up. And I do like that question, how do we perpetuate the knowledge? Um, what a fantastic question to sort of leave open-ended. Um, well, this gives us sort of 60 seconds where I'm going to ask you as many questions as possible.

I do love a challenge. Let's go, Dave.

Well, there's no context either, so obviously you could answer both, or some people actually do that on the show. But all right, you ready to go?

Ready.

So it's— sorry, just a little bit more. It's one or the other. I think you've got it. You're like, okay, Dave, I'm a doctor. Okay, risk-reward.

Reward.

Self, others.

Others.

VUCA, VUCAD?

VUCAD.

Board or CEO?

Both.

Bodyguard or hermit?

They're probably the same thing, depends on who you do them for.

Risk is an art or a science?

Both.

Organization or society?

Both.

Carve McGrath or Street Fighter?

Same.

Compliance or resilience?

Same.

Risk or gamble?

Risk is a gamble.

Agreement or alignment?

Alignment.

Oh, you're back to picking them. Founder or career CEO?

A bit of both. Let's not be binary.

Decision or hold off?

Context.

Intuition or analysis?

Both, depends on the problem.

Meditation or exercise?

Both, depends on what you want to achieve.

Opportunity or risk?

Almost always opportunity because opportunity is part of risk.

You're just giving the context as we go. This is great. Proactive or reactive approach?

A bit of both, but mostly proactive. I'd say the right mix is 70 to 80% proactive, 20, 30% reactive capability.

Oh my gosh. Okay. Soft skills or hard skills?

Both. Depends on the problem you wanna solve. And here's the one back for you. Neither, because they should be core skills.

There we go. Well, we might leave it on that. Thank you for the context. Yeah, thank you for today's conversation, Gav. I knew it was gonna be a fun-filled conversation 'cause your passion for all things risk, your models, your thought that you've put into this, the business, the energy. So really appreciate you coming in and sharing all of this. And like I said, we've definitely got another podcast worth of content to go through. Uh-huh.