R2A's Due Diligence Process - Why it works

In this episode of Risk! Engineers Talk Governance, due diligence engineers Richard Robinson and Gaye Francis discuss R2A's preferred approach to due diligence. 

They explain why they start with a top-down approach, usually starting with the military intelligence, threat and vulnerability technique. And how often organisations who have started with a bottom-up process have been floundering for some time, come to R2A to cut through the detail.

Richard and Gaye also discuss:

·      importance of selecting the right tools and techniques for the job,

·      need for multiple perspectives and approaches to ensure a comprehensive analysis, 

·      importance of bringing key stakeholders together and the challenges of working in silos, 

·      need for preparation and adaptability in the due diligence process.

 
Please note the matrix mentions is available in all R2A publications. You can find these at https://www.r2a.com.au/store

If you'd like to learn more about Richard & Gaye's due diligence work at R2A, head to www.r2a.com.au or get in contact at admin@r2a.com.au.

Transcript

Megan (Producer) (00:00):

Welcome to Risk! Engineers Talk Governance. In this episode, due diligence engineers Richard Robinson and Gaye Francis chat about their due diligence process at R2A and why it helps their clients. We hope you enjoy their chat. If you do, please give us a rating. Also, don't forget to subscribe on your favourite podcast platform.

Gaye Francis (00:25):

Good morning, Richard. Welcome to another podcast session.

Richard Robinson (00:28):

Morning Gaye. Been a busy couple of weeks.

Gaye Francis (00:30):

We have had a busy couple of weeks. It's been good and interesting.

(00:36):

Today we're going to talk about R2A's preferred due diligence approach. We often get asked why we do things a certain way and we've covered in another podcast, I believe, the different tools and techniques that are out there and that there's many tools and techniques out there. And one of the first things that you've got to do is select what you're going to use.

Richard Robinson (00:56):

Which of the approaches you're going to use out of the eight by three matrix that we suggest is available to you (refer R2A texts).

Gaye Francis (01:02):

That's correct. So part of today's podcast has been recorded because we've been congratulated, which you don't often expect as consulting engineers to be congratulated on doing a job well done. It's just I guess what you expect when you get paid to do something. But we've had a number of stakeholders come up to us after workshops and say: That was a really good process, I really understand what we are doing now. So we thought we'd go through the approach that R2A uses.

Richard Robinson (01:30):

And anybody lives on the 65th floor who thinks that, yes, it's kind of interesting, isn't it?

Gaye Francis (01:39):

So do you want to kick off and I'll throw some comments in?

Richard Robinson (01:42):

Yeah, by all means! So what we thought we'd do was actually just explain which approach we prefer to start with.

(01:48):

Now what we tend to do is start with this one, and if it doesn't work, then we go scratching around looking for other ones. I mean, for example, in three by eight matrix, the legal review, we always suggest that ought to be done, but we don't start with the legal review. That's something that once you've gone through your process, you get the lawyers to actually check. And it actually is quite important because Gaye has talked about this and she keeps forgetting the line. I keep making the (Immanuel) Kant remark that engineers seem to like: The meanings in the process, the results are only consequences. So whatever analysis or review process you adopt that will define the consequences.

Gaye Francis (02:25):

There are types of results that you're going to get from.

Richard Robinson (02:28):

And we keep coming across people who started with bottom up processes and they wonder why they get lost in detail and floundering around. And I've got to say that's the reason why we actually get quite a lot of work is because they've been floundering around for quite some time and they're rather desperately looking for somebody to sort of cut through the Gordian knot and bring in the thing to a useful place.

Gaye Francis (02:44):

And resolve the situation, isn't it, that they can make a decision going forward?

Richard Robinson (02:48):

Correct. So we just thought we'd say, well, okay, this is the approach we normally take.

(02:53):

Now we always start top down and the only really effective top down approach that we know about is the military intelligence, threat and vulnerability technique. That's where you spell out what you're trying to protect, what's important to you, what the credible threats to what it is you're trying to protect are. And then you look to see whether those threats expose what you're trying to achieve or protect. And if you find one of those, that's called a vulnerability just for the record. I mean Asia for example, does threat assessments. They don't do hazard assessments. That's what organisations and bottom up tends to do hazard assessments.

Gaye Francis (03:27):

But there's a whole lot of ways that you can do the threat and vulnerability assessments. So sometimes we look at critically exposed groups.

Richard Robinson (03:33):

Which we did for tunnel and fire design.

Gaye Francis (03:36):

You can look at it on a functional basis.

Richard Robinson (03:38):

Which we did for safety cases for ports like Sydney and Sydney Harbour and other places.

Gaye Francis (03:43):

Which comes in as a geographic basis as well. And then you can do other completeness checks for railways, for example. You can do the different train types, different collision types, different track types. So there's a whole lot of ways that you can get...

Richard Robinson (03:57):

The last job we were just doing was done by task.

Gaye Francis (04:00):

Yes.

Richard Robinson (04:02):

We went through and broke down the tasks. We then also came back and double checked against critical exposed group, make sure we didn't have overlook anything. But that means we took two cuts through at a high level. And I think that's the point. One of the points we keep making; risk is this multidimensional creature. If you think a single cut is going to get you the answer that you want, it's probably not the case. I mean, we always suggest you have the lawyers review it, come hell or high water anyway, because it's got to work for the lawyers because if you don't, it won't survive post legal scrutiny.

Gaye Francis (04:30):

But I think one of the interesting things with the job that we just did when we did look at the tasks that were being done, there are a whole lot of controls that came out of that. But then when we went through the critically exposed groups, there were some additional controls. So I think sometimes you do have to have that, because it is multidimensional, you've got to have a number of ways of looking at it and checking it to make sure that you haven't overlooked anything. And that's one of the ways that you do do your completeness check.

Richard Robinson (04:56):

Now having done that though, when we're looking at a particular vulnerability, the way we tend to like to do that is just to write out a single line threat barrier diagram. Now that's a very Newtonian way of thinking about things. If this then that time goes on and flows in one direction, there's no quantum mechanics, it's just a single flow of ideas. And that's certainly what we used in the VCAT proposal and certainly what we used in the last two reports that we've done. And the reason why we particularly like using this, from the point of view we explain in the hierarchy controls, it's one of the really crisp ways to present the elimination option always comes first. If you can't eliminate, then you say, okay, can we prevent it from occurring? If you can't prevent it from occurring, you say, right, can we mitigate the scale of the consequences? We prefer that to multi bow ties, motor alarm bow ties, because everybody gets lost.

Gaye Francis (05:49):

And I think we've been using it more to get everybody on the same page and to almost set the context of the review. We don't often use them as an analysis tool. They're often as a communicational explanatory tool. So it gets everybody on the same page that focuses them on the key issue of concern. These are the controls that we've got in place. These are the possible additional controls you could have. And then you may or may not need to go to another level of detail to determine what's reasonable or not.

Richard Robinson (06:19):

And just remember whilst we start that way, it isn't always the way. I mean, for example, we're doing that Supreme Court expert witness job on the effect of rolling blackouts. And we started off trying to use threat barrier diagrams to describe all the scenarios that we could think of. And in the end, you actually couldn't do it. We had to actually go to a probabilistic basis, an epidemiological basis rather than a causal Newtonian basis.

Gaye Francis (06:45):

And that was because there wasn't just a single cause associated with it.

Richard Robinson (06:48):

Well, there was a single cause, but the mechanisms were so varied. So people were getting trapped in elevators, blood blanks freezing over, trains stopping in tunnels, and all sorts of complexities. But there's a whole multitude... And all the traffic lights going out tends to cause a bit of chaos too.

Gaye Francis (07:04):

It sort of sets the context for the review as well. When you're determining what's reasonable.

Richard Robinson (07:09):

Now, when we're actually look at the threat barrier diagrams, the other thing that we do, and we've just been commissioned to do another major review - This one's an international one, just! - but what we then do is when you're looking at the particular barrier in the threat barrier diagram and saying how reliable is that barrier? In terms of trying to explain it to somebody, the best tool we've found to use it is reliability block diagrams or success block diagrams. So the success block diagrams describes what elements provide success for that particular barrier. Now, the advantage of doing that is that the threat barrier diagram then remains fairly uncomplicated because just whack in what that functional barrier is, and then you explain in the reliability block diagram all the elements and what needs to achieve.

Gaye Francis (07:52):

I think one of the interesting things with that as well is it often shows the weakest link in the chain and it's often not the one that you're focusing on. And so it's no use putting in another barrier that's really, really reliable and gold plating something if you've got another barrier in there or another element in there that's actually limiting the success of that whole chain.

Richard Robinson (08:18):

If you've got a single point of failure, it's always going to cost you mega dollars to gold plate it, and that single point of failure will not go away.

Gaye Francis (08:26):

And I think that was one of the things that came up in the recent jobs, wasn't it? They were focusing on a particular issue of concern. And when we went down to that, and we did need to go back down to that reliability block diagram level, the issue that they were trying to resolve the solution was totally different to the original one that they were looking at.

Richard Robinson (08:45):

Correct.

Gaye Francis (08:45):

Just to address that common mode failure, because if they didn't address that common mode failure, whatever they were talking about doing would've had immaterial impact.

Richard Robinson (08:56):

The other key point in all this, which I think is actually really important, I suspect that's one of the reasons why we keep getting a job out of all this, is that the whole point of the WHS Legislation (OHS Act) going back from Maxwell QC when he wrote his thing, was that one of the core frustrations of the health and safety business was that people had split responsibilities. And the fact that somebody over here failed to do something, the people were saying: Well, it's not my job, it's their job to get it right. And he said: Well, no, that's not right, to the extent that you have to control, you've got to do stuff and you can't just keep blaming the other person and not doing anything, you've got to get on with it. So in both the last couple of jobs, there's been a tendency for somebody to say: Well, this is the responsibility of, say a fire engineer and you, the fire engineer, have to sign off on the problem; it's all your problem, the rest of us just sit back and wait until you figure it out and sign off.

Gaye Francis (09:46):

And the poor fire engineer says: No, no, no!

Richard Robinson (09:49):

I'd sooner withdraw from the job. I'm not taking responsibility for everything that could go wrong. Mainly because you people want to have some other solution which provides operational benefits, but you're not willing to take into account these serious long-term consequences of that fire design. Which by the way, as the fire engineer, I inherit for the rest of my working life. So it's actually quite interesting and it's rather interesting from my point of view -- I obviously started life as a fire engineer with Faction Mutual, and I guess I was doing this before it was trendy, but I moved on to being a due diligence engineer. But when you put the due diligence context together, the fire engineer is particularly pleased to say: That makes sense! I'm with you.

Gaye Francis (10:31):

I think that's one of the other benefits of the due diligence approach that we do. I mean, we said this on a number of occasions, the tasks that we usually complete are generative interviews to come to get a first cut of the situation before you go into a stakeholder workshop. You never go into a stakeholder workshop unprepared or with a blank piece of paper. That could always lead to disaster. But I think one of the things that the due diligence approach does, and there's been multiple stakeholders in the last few jobs that we've worked on.

Richard Robinson (11:01):

Multiple multiples.

Gaye Francis (11:02):

And they've often been doing their things in their own little silos. And this is the first approach that's brought them all together to bring them onto the same page. And so I think collectively, they could then go forward. Whereas when you're trying to solve it in your own silo, it's almost impossible.

Richard Robinson (11:21):

Well, that's what the case is. And what happens is you get these huge delays and after a while the delays get so large that the whole process stalls. But you might remember, we noticed this when we were doing the Gold Coast, the Tugan bypass, the tunnel under the Gold Coast airport. You remember we had that workshop, and I thought it was pretty tough because the Queenslanders were fundamentally paying for it, but it went under the Gold Coast airport. So that means it had the federals in there, and it then sort of popped out in New South Wales. But the New South Wales regulators were giving everybody hell. And nobody would agree. And it wasn't until we ran that last workshop. We did not previously prepare for that one that, well, I recall.

Gaye Francis (11:58):

No, we had about 54 stakeholders across all of the jurisdictions. So it was a pretty exciting time.

Richard Robinson (12:05):

Absolutely. And yet we managed to land it. Now, what I also understood about that, it wasn't so much that our process per se was the most brilliant on the day, but the process of getting the right people in the room and taking it through a structured process does work.

Gaye Francis (12:20):

Yes. Yeah. So any last comments? So that's what we thought we'd share with you today. I hope you found it interesting. Again, not a single size fits everyone.

Richard Robinson (12:32):

Well, you might recall we were doing that Warragamba Dam upgrade. Remember how we started the process and it didn't go well, and at lunchtime we had a sudden... We need another approach here! And we found a way forward that we could land it through the group.

Gaye Francis (12:49):

I would've preferred to end on our successful jobs that we've used, our preferred process. But yes, I guess it just shows...

Richard Robinson (12:55):

<laughs> My point being that you can't just assume it's going to work every time.

Gaye Francis (12:59):

That is true. And you have to have enough tools and techniques up your sleeve that you can adapt if you need to on the day. But preparation, preparation, I'm all for that.

(13:09):

So thank you for joining us and we hope for you to listen next time. Thanks.

Richard Robinson (13:14):

Thanks.