Is your risk register fit for purpose?

I mean, just before I start my little talk on risk, I mean, I'd echo a few of the things that both, you know, Tony and Rob said. We started this master's programme back in, I think it was 2005. 2005. Ken Meeks mentored me into UCD after I did my MBA here, and he'd started the full-time programme, and the two of us put together what was at the time a project management master's in project management practice. So we had two separate kind of master's programmes, and I co-authored that with him, and we launched that, and that was one of the first part-time, I think, master's which runs kind of in the evenings, and that was combined a bit later on with the full-time master's. So we just have kind of one offering now, but we deliver it in the 2 modes. So Rob was interesting because he was a seasoned professional who came and did the full-time programme. But typically, you know, people with post experience would come and do the part-time programme, a couple of evenings a week over 2 years. And if you look at that end of the room, quite a few of the bodies over here are going through that pain at the moment. They haven't all got grey hair, they're surviving the process, and most of them are smiling. We try and make this a programme which is practical, because project management is about getting things done at the end of the day. So it's a very practical programme, it's aimed at teaching people the skills but also linking them with the knowledge. And it's great to see Maxim in the room, Maxim Mitarev over here, one of our newest faculty who joined the programme last year. Maxim is one of the premier researchers in the world on project management. So the programme is informed by top-quality global-level researchers, as well as people who, like myself, I'm not a research-active academic, okay, but I was a global manager with General Electric running 3,000 people and projects all around the world. So we bring this kind of confluence together of, you know, academic ability, of good backgrounds in practical project management, And hopefully that brings together a programme which offers something of everything and brings the value from both sides of the house that Rob was talking about. And the access that you get when you sign up, it is not cheap to come here, but we do not apologise for that, because you get a lot. You get the benefit of all the faculty, but you get the benefit of all the resources that I mentioned earlier on. And when I came for the MBA back in 2003, I was still working with GE. I was still working in a global role. I came because I'd come to Ireland in 2000. And my primary role, if you like, in coming to do the MBA was I need to plug in. So this idea of networking that we're exploring tonight, I need to plug into the Irish business network and stuff like that. And that was it. And I kind of poo-pooed this thing about, well, what's academic got to teach me? What am I ever going to get out of a university? This is project management. This is business. They don't really know much about it. Boy, was I wrong. Because most of the time, it's the university staff and the university researchers who have the time to step back from the chaos, from the grind of churning out the projects and getting the jobs done in what a lot of people call the real world. But this isn't an ivory tower. This is also part of the real world, but it's part of the real world where people who work in a university setting will generally have quite a lot of their time dedicated to looking at processes, looking at institutions, looking at how things are done and how things have been done and how things might be done differently. Because the way it was done 10 years ago, 20 years ago, 50 years ago probably can be improved today with new techniques, with new materials, with new knowledge. But it's kind of only when you have somebody who is objective enough to step back and invest some time in trying these new things and measuring and writing that up and subjecting that to the critique of peer review that we actually move the science, if you like, of project management forward. Pat runs a consulting firm, I consult on a regular basis, Rob consults. A lot of the staff at Smurfit don't just do academic teaching, we are out there. This is a business school and you have got to be out there in business, you have got to be out there working with businesses and working on projects and with people who are running businesses and running projects. So we try and keep it real. So that's why I've put this little presentation up this evening to help. I spent the day down in town with one of the biggest insurance companies in Ireland, talking to them and running through their stakeholder and risk management processes. So I'm warmed up, okay? And I'm going to give you a little bit on that in terms of this. But before we start, let me just start with this.

I flew United Airlines on my way to Nebraska. The plane departed Halifax, connecting in Chicago O'Hare. While on the plane, I was reading a book. The passenger said from the seat behind me, my God, they're throwing guitars out there. The band and I exchanged a look best described as terror at the action on the tarmac and knowing whose projectiles these would be. So before I left Chicago, I alerted 3 employees who showed complete indifference. Towards me, united, united. You broke my Taylor guitar, united. Some big help you are. You broke it; you should fix it. You're lying. Just admit it. I should have flown with someone else. Gone by car. 'Cause United brings guitars.

That was 2009. Within 4 days of that song being posted to YouTube, stock price had gone down $180 million. We all have one of these today. We can all make videos. We can all post them to YouTube. That's why we're talking about risk. So, I just want to spend maybe half an hour just kicking around some ideas around risk and just showing you a little tool that I've developed over 10 years of teaching risk here and both consulting in risk in many organisations. This tool that I'm going to show you tonight is in use by the Irish Defence Forces, it's been used by Microsoft, it's been used by Dell, it's been used by quite a number of large organisations. I'm not saying it's a panacea, okay, just maybe a way of thinking about risk. So is your risk register fit for purpose? Have you got a risk register? There's kind of that assumption, isn't there, in the question mark. I'm terrified sometimes at the fact that a lot of companies don't have a risk register. I run the Master's in Project Management. I coach and run project management in industry. I do quite a lot of work with charity. I helped set up Pieta House and I was chair of their board. I've been a chair on the Wheel. 20-odd years managing teams at national, international level and lecturing. And I, even after 10 years here, put myself through the Professional Diploma of Teaching and Learning to figure out that I actually maybe should learn how to teach. Yeah, fortunately most of it I was getting mostly right, but learned a lot there as well. So do you have A risk management policy and procedure? Or do your clients have risk policies and procedures? And if they do, does it just sit on the shelf or does it actually get used? Because this is a very overlooked part of the project management toolkit, I guess. I've done quite a lot of work over the last couple of years with Tuzla. They've been in the headlines. They've gone through their problems. They've gone through their issues. But whether it's Tuzla in child protection or whether it's a commercial company, headlines are not fair. The media can be merciless. And if you get it wrong, if it's wrong on your watch, if it's your project that causes people harm or causes people loss or causes people injury or whatever it is, they are going to come after you. No doubt about it. And that can wreck your career, that can wreck your company, that can wreck your consulting, all kinds of stuff. So this isn't something that you really can ignore, not if you're sensible. As a seasoned professional. I love that. You're never going to live that one down, Rob. A seasoned professional. It's wonderful. Thanks, Dennis, for that little snippet.

That was brilliant.

This is how I get people to think about risk when I'm talking about risk in a project setting or in a commercial setting, because a lot of people, when they start thinking about risk, think about risk areas. Finance is a risk. No, it's not. Finance is a risk area. But as a project manager, as somebody in a business trying to mitigate risk, trying to insure yourself against stuff going wrong, think about this. Think about a potential negative consequence event. So when you're thinking about risk, define the events that you don't want to happen. Define the events that you don't want to turn into, from being that potential thing into a reality. Yeah? Think of it another way. What causes the phone to ring? Pat, there's a great big problem. Yeah? You're CEO, come and fix it. Tony, there's a great big problem. Yeah? What do we do?

Okay.

What causes the phone to ring? And the phone never rings, does it, at 2 o'clock on Tuesday afternoon? It's always midnight or Christmas Eve or the worst possible time that it could be. This is Smurphy, not Hogwarts. We're not Hermione or Ron. And yet as project managers we're supposed to have mastered this crystal ball. I don't think it appears on any of our curricula.

No.

Mastering the crystal ball? Yeah, but perhaps it should, because that's actually what we ask our students to do. That's what we ask our graduates to do. That's what we expect consultants and project managers to do, is to look into the future. It's kind of divination. Am I supposed to know what's going to happen? That's what we're paying you for, because you're a project manager. You should know this stuff.

Big word.

Big word when it comes to risk. Big word when it comes to running effective teams. Big word when it comes to keeping customers happy. Trust. Really interesting example in Recent months, I think, has been Volkswagen and the emissions scandal and their efforts to rebuild trust. Would you have coped with something like that with your company, with your projects? It's a very difficult thing to focus on because Once trust is broken, it's like kind of, you know, do you ever remember kind of having that big row with your first boyfriend or girlfriend? Or, you know, breaking up with them? It's never quite the same again, is it, afterwards? Once trust is broken, you can stick it back together, you can try and mend it, but it's never quite the same again. So this is a really, really important part of the process. We have a lot of stuff to help us. Most of you in the room, I hope, will be familiar with this document, the PMBOK, the Project Management Book of Knowledge. This is from version 6, the current one. Pages 395 to 458. Deal with risk. It's a big chunk of the book. There's a lot in this. We have a master's programme in project management with 7 taught modules and then a 2-module equivalent kind of final report. One of those 7 modules is on risk. This is important. It's a big chunk because it covers Pretty much everything you do in terms of project management, risk will touch. I spent the morning going through stakeholder management with this client this morning in town. Every stakeholder, every person with an interest or is affected by or can affect a project, their view of a stakeholder— they showed me their project charter document, which was a one-page charter on They were very proud of this. We have a one-page project charter and the stakeholder box was a centimetre deep. You could get about 2 names on it. Their assumption was the stakeholders are the 2 key decision makers who make the go/no-go decisions on a project. We had an interesting 2 or 3 hours exploring the concept of stakeholders. Pretty much every stakeholder in a project is a risk. especially if they're resource providers. Because what if they don't? What if they suddenly can't provide that resource or stop providing that resource or change their mind and fall out with you or whatever it is? So, I mean, here's the classic process. You identify risks, you assess them, figure out how many of them you can possibly address, typically by going with something like impact and probability and multiplying the numbers up. You start with the high numbers. Then you figure out some kind of risk response development. Then most of the time that is where it stops. Draw a line at that point. Because these are potential negative consequence events and, touch wood, most of them won't happen. But some of them do. When they do, you have to go down to the bottom. And you've got to actually implement the stuff that you've put in place when the catastrophe happens, when that incident happens. And this is the common risk register. This is what I get 90% of the time when I go into a company and I ask them to show me what they've got for risk. And this is what they show me. And this is what I do. So I thought there must be something better. So I went to the PMBOK and I kind of mined that, and I went to my own experience and I mined that, and I pulled stuff from various different places, and I now have this little Excel spreadsheet-based tool which every time I show it to a company, they go, oh my God, this is great, this is so much better than what we're using at the moment. Can we have this? Can we use this? And, you know, yes, they can, and they can use it and they can tweak it and they can— so I thought I'd just show you this tonight. We've got a few minutes. So I'll fire up Excel and we'll We'll walk you through this and hopefully it might give you some ideas or whatever. So if I flick over into Excel, kill this show because I'm on full screen. Come on. All the stuff that's in the normal risk register is obviously still in here.

Okay.

A good risk register starts with a good risk description, and that's why I qualify my, you know, risk kind of teaching around that definition of a risk, a negative consequence event. So whenever I'm kind of taking people through risk analysis and risk management, I tell them, okay, let's start with the description. I want you to spend a lot more time on your descriptions, because if you can describe the event that you're trying to avoid happening and you can clarify that, then you can start to think about, okay, how do I stop it happening? Or if it happens, how do I mitigate the fact that it has happened more effectively? But if you don't clarify it at the start, Start the event that you're trying to avoid, it's very difficult to put any meaningful controls or, you know, things in place to either eliminate that possibility or mitigate that possibility. So your risk event description is really, really important. And, you know, you can break a description down into kind of like the event that I'm trying to avoid.

Okay.

The things that contribute to that event and the effects that that event will create. Those 3 elements need to be in your description. Now that means that very often, if you're doing this for any, any kind of size project that's, you know, significant, you're going to have a lot of Risks. But yes, you've got a lot of risks in a medium or a big-sized project. And that's one of the problems, is that a lot of people, they don't want to go through the process, they don't want to go through the discipline. Project management is a discipline, it's not rocket science. Although I did have the pleasure of being invited to teach a project management module last year to the rocket scientists in the School of Physics. So I was able to open my lecture with, project management is not rocket science. Oh yes it is. I loved that line, it was great. But these guys are actually putting satellites into orbit, the little square 10 centimetre satellites and stuff. So this stuff applies whether you're putting satellites into orbit, whether you're Pieter Huyss, whether you're Aspire Consulting, whether you're Microsoft, it doesn't matter, it's the basic same stuff. stuff. And identifying what it is that you need to work on clearly. Words matter. This is a university, and more than most places, words matter here. Clarity of thought. Rob was alluding to this earlier on. Clarity of thought. The need to think about what it is that we're teaching, what it is that we're saying, how we project ourselves, how we communicate. Up until last year, the number one cause of project failure in pretty much every survey that was done, and certainly in every PMI survey, Pulse of the Profession report comes out every year, number one cause of project failure, anyone tell me what it was? Not my students. They know. If they don't, I'm going to shoot them. Poor communications.

Cool.

Do you know what it was the last time the Pulse of the Profession report got released in 2018? For the first time in 50 years, it wasn't communication. It was ineffective or disengaged project sponsors. Senior executive engagement. For the first time ever, communication's been knocked off. Maybe business schools are having an effect. Finally, how many people do we graduate every year, Tom?

1,300?

1,200, 1,300? 1,800, 1,000 between here and there. Oh yeah, I mean, if we're talking about, yeah, our satellites in Hong Kong and stuff. 2,000, okay. And we're one of something like 45,000 business schools around the world. We're one of the top 100. If every business school in the world is knocking out, say, on average 1,000 students, half a million students a year are coming out now understanding basic management principles and basic best practice and all this kind of stuff. So great, communication is finally getting recognised, but it is still something that we work with our students day to day, week to week on, is developing their communication skills. Whether that's oral communications, whether that's standing in front of a room like this and being able to project and being able to, you know, engage with an audience and find out what matters to them and hopefully add some value, whether it's written communications. And the clarity then of thought that Rob was talking about earlier on, of how do we express ourselves, what information do we draw on when we are pulling information together, whether that's for a client or whether that's for a research report or whatever it is. it is. And that's where coming to something like— someplace like Smurfit, where you have access to all this amazing information, gives you this whole extra level of possibility. I did, you know, before Smurfit I was doing alright. I was a global manager with General Electric. I mean, yeah, I was doing okay. I had no idea of the power of the academic literature. But once you're exposed to it, and once you become aware of it, even though I'm not research active, Maxim's research active. I read his stuff. I've read Verpi's stuff. Yeah. Fabulous stuff. And if you are aware of this, and you have access to this, and if you're an alumni, you can retain access to it by a reader's ticket. I think it's what, €30 a year or something. And then you continue to have access to all this information. It gives you an edge if you are a consultant, because most consultants who do not know about this stuff, who have never been through a master's programme, they do not have that edge because they have not got that access, because they do not know that it exists in most cases, and they certainly are not leveraging it. So it is an amazing step up that you have got Once you have been through a process like this, if you retain that and if you make best use of it. So identification is the foundation for all good analysis, whether it is risk analysis or whether it is any other analysis. You have got to identify the problem, you have got to identify the pain point, you have got to identify the value that is required or whatever it is before you can build a structure to address that problem. The rest of the spreadsheet is that structure. Now we have the classifications. We have likelihood and impact severity. These are set up in this particular spreadsheet so they are completely configurable. You can set these up based on your own classifications and stuff. We have tabs down at the bottom where you can set those tables up and it does lookups and stuff. Those multiply up to an initial risk score and you can choose a functional area. This is something that generally doesn't appear in a lot of risk registers, but it's actually a little nuance which is quite important. So which particular areas of the business— these might be functional areas of the business, and again you can adjust these as need be— are affected by this risk or could be affected by this risk? Why do we need to know this? You know, if it's people and compliance and finance, then that tells us that we need to get people from finance and compliance and HR in a room to think about this risk. It's not just the project manager's job to think about risk, it's the job of the stakeholders. So if you can identify who are likely to be affected or which groups are likely to be affected, then it just stimulates a conversation. It's kind of almost an aide-mémoire. Okay, right, I need those 4 people in the room rather than just trying to figure this out myself, because you don't know the answer. GE used to run on a little mantra, VOC. Anybody know what VOC means? Voice of the customer? Voice of the customer, VOC. And one of the worst things you can do as a project manager, one of the worst things you can do as a product manager, as somebody who is trying to create some product or services, think that you know what the customer wants. Because you don't. Even if you are smack in the middle of the demographic, you are just one person with one set of experiences, not the rest of it. So anything in your portfolio of tools which helps you focus back on getting more voices into the conversation and the right voices into the conversation is worth having. So that's, that's what these columns do. This is so important. How many of you at home have a smoke alarm? By no means everybody. So the rest of you are happy to burn to death tonight, eh? Haha, never slept. My students have heard this story. So a couple of years ago, 2 or 3 years ago now, I do my risk lecture and the week after there was a student sitting just here. I remember it well. And he sticks his hand up and he says, Joe, that risk lecture last week, you scared the living daylights out of me. I went home via Woody's, I bought myself 2 smoke alarms, And I put them up. One in the kitchen, one in the hall. And 2 o'clock in the morning, bloody smoke alarm went off. And I thought, I must have wired it wrong or whatever. And I almost rolled over and said, oh, it'll stop in a minute. But I got up and went downstairs and opened the kitchen door and the kitchen was on fire. You probably saved my life. Thanks, Joe.

Great.

Happy student. Live student.

Great.

It's one thing knowing that a risk might happen, but have you got any way of detecting that risk before it happens? If it's a detectable risk, if it's one that would trend. A fire you can detect because you can detect smoke, you can detect heat, you can detect pressure changes. There's lots of different ways of Of giving yourself that 2 minutes before the fire's engulfed the house.

Yeah.

So whether it's a fire, whether it's a disaster, whether it's a financial risk that comes to play because you didn't sort your cash flow out well enough. Yeah, well, how can you have a detection mechanism around cash flow? Somebody is tasked with keeping an eye on the current account. And if there's more than, you know, less than 50K in the current account at the beginning of the week, and we know that we're gonna have to pay all the contractors at the end of the week, we need an alarm. Now that might be somebody checking the balance every day, or it might be some automated exception report that dings up and tells us what's going on, but that's a detection mechanism. And I've probably been into Close on 50 companies in the last 2 or 3 years, and I think I've had one company that had some kind of detection mechanism built into their risk register. This ain't rocket science. Project management is applied common sense. But how common is common sense? So building in a question about detection Detection mechanisms. One, do you have one? And if you haven't got one, we need to revisit our work breakdown structure, don't we? Because all of a sudden we've now got some new tasks. Somebody's job it is to now go and find a detection mechanism or create a detection mechanism. So that's a number of tasks which are going to require time, are going to require resource, are probably going to require a bit of our budget. And all the rest of it, and we need to fold that into our overall project plan because we can't deliver this project without this stuff being in place. We need a person responsible. We need alarm points setting because it's no good having a detection mechanism if it doesn't go off. So what are those alarm points and how long a, you know, a pre-warning are we going to get before before we see this stuff. Your typical risk register will have a column for responses. What do we do about this risk? But again, that isn't enough. That doesn't capture any real— any of the nuances of what you need. So yes, we need a response, and I should probably make that P column a little bit wider.

Yeah.

So we've got response types, okay, and you can set those up. So we've got prevention, reduction, transference, contingency, or acceptance. Ideally, we prevent. We do failure mode analysis or, you know, work backwards and engineer the process so that that particular risk can never happen. That's the ideal— eliminate the risk completely. The risk is tunnel's going to collapse on us during construction. So we make a decision early on in the project, we're not going to tunnel, we're going to go over land. That risk disappears based on the project decision we've made. Prevented. Gone. Most of the time you can't prevent. Most of the time the constraints that you're operating within mean that you've got to take this risk on. But what you can sometimes do is you can reduce the risk by changing your methodology. Or by changing your material usage, or by using a different material or something like that, using a different technology. So that's a possibility. Transference is typically insurance, get somebody else to take some of the risk on. And contingency is, well, we can't actually do anything about that earthquake, because at the moment our technology doesn't allow us to do anything about earthquakes. We can't make those massive changes in the Earth's crust. So, But what we can do is we can preposition water and radios and stuff so that in the event of an earthquake— and we can train people in, you know, how to be safe in an earthquake and all that kind of stuff. So that's contingency, but that will only really typically kick in after the risk has turned into an incident. And then acceptance— look, we'll just live with it. Ah, sure. We're fine.

Okay.

But now we come to the kind of slightly newer stuff in terms of what's not on a normal risk register. Detailed response actions. History is littered with companies who failed to react quickly enough and effectively enough after a natural disaster. Exxon Valdez, classic example in the literature of a really badly handled disaster when the oil spill from the Exxon Valdez occurred. And it took days and days before the board made any decisions and before they sent help up and all the rest of it. Massive ecological disaster. It's actually been in the news again this week. Many other cases where companies were not prepared. And this is the thing about risk management. It's not good enough to react after the fact when you can foresee that this kind of thing is going to happen. If you run single-hulled oil tankers, at some point one of them is going to run aground, and if it runs aground and it's a single-hulled oil tanker, there's going to be a spill. That's a foreseeable risk, and it's on you as a project manager or as a company owner or whatever it is to have done enough about that to reduce that or to have things in place, because the time to figure out that your ship is sinking, or that your house is on fire, or that your plane is crashing, is not at 35,000 feet when you're in a dive. You should have prepared this stuff ahead of time, and people should know where to go. And that's what a good risk register does. It allows you to think this stuff through ahead of time, communicate it to your people. I think one of the primary roles of any manager is to keep their people safe. When you're in a managerial position, when you're in a leadership position, I think one of your primary roles is to keep your people safe. The people who report to you, the people who you direct, it's your responsibility to set them up for success but to keep them safe. And if you're not doing this stuff, you're not doing that. You're not keeping them as safe as you could be. You're not setting them up with what they need to insure themselves against stuff going wrong, those potential negative consequence events. This stuff never goes wrong at a good time. So if the CEO is on the notifications list, have you got their phone number? Not just their mobile, is their home phone number on there? Who do you need to notify? Is it the CEO? Is it legal counsel? Is it the media representative? So there's probably a list of people and that stuff needs to be on here and this stuff needs to be accessible on a shared drive that everybody can get to and everybody needs to know that, you know, For any given project, it's the risk log or it's the risk register or whatever it is that they need to go to to get this information. Anybody got their private pilot's license? Flying a plane is easy. I can teach you how to fly a plane in like 15 seconds. Down, up, left, right. But you don't get your private pilot's license unless you've done about 200 hours. Now, quite a lot of that is radio stuff. And figuring out how to get from A to B and map reading and all the rest of it. But a good proportion of those 200 hours are spent in risk. What do you do when a bird strike happens at 10,000 feet? What do you do when the oil light comes on? What do you do when your radio dies? Because the time to figure that out is not at 10,000 feet. When you're bleeding from cuts on the eye and there's Air coming in through the broken windshield and you're in a spin. The time to figure that out is by having gone through the process of practicing, figuring out, reading the manual. And that's why there is a manual in every single aircraft which is specific to that aircraft, and it is a composite of all the things that have ever gone wrong on that airframe. And every time there's something else goes wrong, like the The stuff in the news in the last few weeks.

Yeah.

The manuals for those aircraft types will be updated with all that stuff that's gone wrong and the changes that they've made to the avionics systems that they announced yesterday. And you learn that. You have to learn that book. And your co-pilot has to learn that book as well. But the book is in the cockpit. Well, it used to be until last year, and now you can actually have an iPad. It used to be paper and now you can actually all have it on an iPad, but so that you can reach it, you can reach the book and you can open the right page and you can work the checklist. And this is the same kind of thing. Okay, so this is your checklist of what to do, who to contact, okay, who to notify, but who acts. If there was a— something awful happened With one of your products or your services. RTE doorstep you on the way into work. Okay, there's a news crew. Would you like to comment for the 6:01 News? Are you allowed to? Are you allowed to speak for your organisation? Have you had any media training? Do you know what you should say, what you can say, what you're allowed to say?

No.

that perhaps might be okay as a holding position or wouldn't make things worse or whatever. That's the kind of thing that a good risk analysis will highlight. You know, if we screw things up, who's our media representative? And everybody needs to know that the default position when somebody sticks a microphone in front of you is, no comment. Yeah, I'll put you in touch with our media representative. I'm going to do it as soon as I get in the building. If you've never trained anybody in that, you've never told anybody that, you've never worked that out, they'll say, oh, oh, oh, yeah, it's awful, isn't it? Yeah, we should never have let it happen.

Oops.

You've just admitted liability and now the company is up for £2 or £3 million payout. That's why risk is so important, because it's thinking ahead through these possibilities. Who's supposed to act? how fast, whether it's Exxon Valdez, whether it's Johnson Johnson, these disaster stories primarily came down to the right people weren't informed fast enough, the decisions weren't made quick enough, and they didn't make good decisions about what to do fast enough. Disaster response is all about pre-planning and putting that pre-planned action plan into play rather than having to think on your feet. And that's why you put your checklist in. And that checklist might be a page long, might be 2 pages long, because you can't think clearly when the house is on fire and the kids are screaming and you've never practiced getting out of the house. Those of you that have got a smoke alarm in the house, how many of you have A fire extinguisher upstairs and a fire extinguisher downstairs? A lot less. So if there's a fire in your house tonight and you open the bedroom door and the hall and the landing and the stairs are on fire and the kids' room is down that end of the hallway and your room's at this end of the hallway, what do you do? I have 2 fire extinguishers behind the bedroom door. One's a water and one's a foam. This is a foreseeable event. I've got 2 young kids. It's up to you. It's your responsibility as a manager It's your responsibility whether you're a project manager, whether you're a leader, whether you're a line manager. You are in loco parentis for your people. You gotta keep them safe. You gotta do this stuff. This is not optional. And then measure, change, measure again. A lot of you will be familiar with that kind of, you know, DMAIC, Six Sigma type approach. Define, measure, analyze, implement.

Control.

Okay. So we did our kind of classifications before we started doing our response controls, and now we figure out our responses and we put in our detection mechanisms and we make sure we have all that stuff in place, and now we do a reclassification. And hopefully our impact or our probability should be lower after doing all that stuff, otherwise we've wasted our time. Or we've not done enough. So that should kind of bring you to a better delta position. And then the last thing is review dates, because some risks need a regular review every month, some risks should be reviewed every 3 months or every 6 months or every year, but all risks should be reviewed on a fairly regular basis because things change. And just because that risk was a minor risk a year ago, the market was very different a year ago. If we rewind politics 2 years, 3 years— if we rewind 3 years, are we pre-Trump?

3 years ago?

Just about, I think. We're certainly pre-Brexit. The world doesn't stand still, and risk management is a way of us trying to put some order on the chaos. So I hope that's given you some things to think about. Woodies are going to do well tomorrow, I'm sure. So, are you and your team fully capable and active in risk process best practice, identifying and running those both in strategic and operational areas? Because risk needs to be done at a strategic and a kind of an organisational level, and then it needs to be decomposed down into the business kind of levels and the project levels.

Yes.

Because it's the same process but they're different risks. They have different sizing and they have different potential impacts. So have you got this stuff in place? And if you haven't, how are you going to put it in place? Note it down, discuss it with your team, set specific time-bound targets. This is a goal, and a goal should be expressed as a specific, measurable, It's 10 to 8. I hope I haven't rambled on too long. Thank you for your attention.

Thank you.