BIQ01 - What is the official name of your organisation/project (and any registration number if you have one, plus main contact, email address and phone number)?
Water Industry Development Project - Major Projects Risk Governance (MPRG) is an illustrative PHC project record created by David Winter for interview preparation and project-governance demonstration. It is not an official company project record. Main contact for this illustrative PHC record: David Winter, davidwinterg8@gmail.com, 07484 323339.
BIQ02 - Are you registered (NGO / CBO / company / informal group)? If not, do you want to register?
This is not a separate registered organisation. It is an illustrative project-governance model created within the PHC Service framework. If implemented in a live environment, it would sit within the company’s existing organisational, PMO, governance and procurement arrangements.
BIQ03 - What location(s) do you operate in (town/county/region)? Any plans to expand?
The illustrative project relates to the company’s operating region, non-specific but with particular relevance to the company's major-projects PMO context. The model could be applied first to selected major projects and then expanded across the wider programme infrastructure and partner-delivery programmes.
BIQ04 - What problem are you solving in one sentence?
The project addresses the risk that a large infrastructure programme becomes too complex for risks, mitigations, partner updates, evidence and escalation to remain consistently visible, owned and actively managed.
BIQ05 - What does "success" look like for you in 6 months and 12 months?
In 6 months, success would mean a clear risk-governance rhythm is operating on selected major projects, with current registers, named owners, realistic mitigations, partner updates, QSRA/QCRA outputs and escalation routes. In 12 months, success would mean risk data is demonstrably supporting delivery decisions, contingency advice, schedule forecasting, partner performance reviews and senior leadership reporting across a wider portfolio.
BIQ06 - What is your biggest constraint right now (money / people / equipment / skills / trust / transport / time / other)?
The biggest likely constraint is not a single resource issue but integration: bringing together project teams, external partners, planners, cost managers, change managers and leadership into one practical risk-management rhythm. Skills, data quality, time pressure and partner consistency are also likely constraints.
BIQ07 - What are the top 3 priorities you want help with immediately?
The top three immediate priorities are: 1) confirm the current risk-management process and tool configuration; 2) review the quality and completeness of key project risk registers and mitigation actions; 3) establish a reliable reporting and escalation rhythm linking risk exposure, mitigation progress, QSRA/QCRA outputs and partner updates.
BIQ08 - What partners do you already work with (government, clinics, schools, NGOs, churches, local leaders)?
In a live company programme context, partners would include delivery contractors, engineering consultants, project controls teams, environmental specialists, regulators, local authorities, supply-chain partners and internal company teams across major projects, operations, asset strategy, planning, cost, change and PMO functions.
BIQ09 - What systems do you currently use (paper notebook, WhatsApp, Excel, Google Drive, website, none)?
The live company environment is understood to use enterprise risk-management tooling, referred to in the brief as Riskconnect/Riskonnect, with ARM/Active Risk Manager familiarity relevant. The PHC illustrative model would also use PHC Port structures for concerns, risks, actions, evidence, deliverables and reporting, while respecting existing company PMO systems.
BIQ10 - Do you have permission/consent from people on your register to store/use their data for support services?
For this illustrative PHC project, no personal beneficiary register is being created. If implemented in a live company environment, data handling would need to follow the company’s information governance, GDPR, security and procurement rules. Personal data should only be stored where there is a lawful basis, defined purpose, access control and retention policy.
PSQ01 - What service can you name, with brief description of each that will help the beneficiaries of your project?
The main service is Major Projects Risk Governance Support: a structured process for identifying, assessing, quantifying, assigning, mitigating, tracking and reporting risks across infrastructure projects. Supporting services include partner risk-register review, mitigation-action tracking, QSRA/QCRA support, emerging-issue capture, opportunity tracking, contingency advice and exception-based reporting.
PSQ02 - List your current services (what you do today), and for each: how often and for how many people per month?
As an illustrative project, no live company service is currently being delivered by PHC. In a pilot implementation, services could include weekly risk-register reviews, monthly partner-risk integration, fortnightly mitigation follow-up, monthly leadership risk reports and ad hoc support to QSRA/QCRA sessions. The direct users would be project managers, risk owners, planners, cost teams, change teams, delivery partners and PMO leadership.
PSQ03 - Which services are most needed but you cannot currently deliver?
The most needed services would be live integration with the company’s risk-management platform, access to active project schedules and cost data, formal partner-risk submissions, and attendance at live PMO governance forums. These cannot be delivered from public information alone and would require internal access, authority and agreed governance protocols.
PSQ04 - What are the top 5 needs reported by beneficiaries of your project (health, safety, work, school, counselling, etc.)?
For this project, the top five stakeholder needs are: 1) reliable drinking water and wastewater service continuity; 2) environmentally responsible delivery, including storm-overflow and pollution reduction; 3) controlled cost and schedule performance; 4) clear regulatory and community confidence; 5) safe, practical and well-coordinated construction delivery across contractors and project teams.
PSQ05 - What is the service pathway right now? (How does a person join → receive help → follow-up?)
The proposed pathway is: a project or work package enters the risk-governance scope; existing risks, issues, assumptions and actions are reviewed; risk owners and partner inputs are confirmed; QSRA/QCRA needs are identified; mitigation actions are agreed with dates and evidence requirements; progress is reviewed regularly; exceptions are escalated; residual exposure and management reports are updated.
PSQ06 - What makes your approach different from other organisations (if any)?
The PHC-style approach differs by treating risk as part of wider project health rather than as a static register. It connects concerns, risks, actions, evidence, owners, review dates, decisions and reporting so that risk management becomes an active control process. The emphasis is on follow-through, visibility and decision support, not merely compliance reporting.
PSQ07 - What "minimum service package" could you reliably deliver every month if basic funding existed?
A minimum monthly service package would include risk-register quality review, partner-risk update review, mitigation-action follow-up, exception reporting, emerging-issue capture, opportunity tracking, and a concise monthly project-risk health report. For a pilot, this could be applied to one major project, one programme area or a small portfolio of high-priority programme projects.
PSQ08 - What does a typical case look like from first contact to resolution?
A typical case might begin with a concern such as uncertain ground conditions, consent delay, contractor productivity shortfall or supply-chain risk. The concern is clarified into a risk with cause, event, effect, owner, probability, impact and affected milestones or cost headings. Mitigations are agreed, tracked and reviewed. If mitigation works, residual exposure is reduced; if not, the matter is escalated with evidence and options.
PSQ09 - What are the risks/harm points in service delivery (stigma, security threats, exploitation, misinformation)?
Service-delivery risk points include poor data quality, unclear ownership, over-complex tool use, partner updates arriving late or inconsistently, double-counting of quantified risks, weak linkage between risk analysis and mitigation, unchallenged optimism bias, reporting overload, and risks being discussed without being driven to closure.
PSQ10 - How do you measure whether a service worked? (simple indicators)
Simple indicators include percentage of risks with clear cause-event-effect descriptions, named owners, current review dates, agreed mitigations, overdue mitigation actions, partner updates received on time, risks with quantified schedule/cost exposure, issues escalated within agreed thresholds, and reductions in residual exposure following completed mitigation.
PSQ11 - What services could be delivered remotely (WhatsApp/phone) vs require physical presence?
Remote services could include register review, reporting, partner-update analysis, risk-quality checks, action follow-up, document review and Teams-based facilitation. Physical presence is more useful for workshops, major-project reviews, contractor alignment sessions, site familiarisation, relationship-building with project teams and complex cross-functional risk sessions.
PEQ01 - What equipment do you have? mobile phone? pc? printer? monitor? - list all you have.
For the illustrative PHC work, David Winter has standard home-office equipment including phone, laptop/PC access, internet access and PHC Port access. In a live company role, equipment would be expected to align with the company’s IT/security arrangements, including approved laptop, secure access, collaboration tools and authorised risk-management software.
PEQ02 - How do we contact you? Telephone number? Office Address? Main Contact? Number of people in the management team? Number of people that the project will address?
Main PHC contact: David Winter, Essex, UK, 07484 323339, davidwinterg8@gmail.com. This illustrative project is currently a single-person preparation and demonstration record. In a live company implementation, the project would address PMO leadership, project managers, risk owners, delivery partners, planners, cost/change teams and other stakeholders across selected major projects.
PEQ03 - Where are you working from? Would the office address be your home? a community centre? an internet cafe?
The illustrative project is being prepared from a home-office base in Essex. For a live company role, the working pattern would be hybrid, with remote working combined with physical attendance at project locations as required.
PEQ04 - What equipment is working reliably, and what is broken / missing / shared / borrowed?
No major equipment deficiency is identified for the illustrative preparation work. For live implementation, the key requirement would be authorised access to company systems, especially the risk-management platform, project schedules, cost/risk data, document repositories and collaboration tools.
PEQ05 - How stable is your electricity and internet (daily / weekly outages)?
Home-office electricity and internet are assumed stable for preparation work. Live project delivery would require reliable corporate systems access, secure remote connectivity and suitable arrangements for Teams-based collaboration and office/site attendance.
PEQ06 - Where is your data stored (paper files, phone, laptop)? Is there a backup?
This illustrative PHC record is stored within PHC Port/project working materials. It should contain only public-domain or applicant-generated content. Any live company data would need to be stored only within company-approved systems, with appropriate access control, backup and retention arrangements.
PEQ07 - Do you have a safe place to store sensitive records?
No confidential company records should be stored in this illustrative PHC project. If a live role is entered, sensitive records should be stored only in authorised company systems, following company information-security and data-governance rules.
PEQ08 - Do you have transport (walking, bicycle, motorbike, car, public)? Biggest travel barrier?
David Winter is based in Essex and is open to hybrid travel to the company's project locations. The main travel barrier is the distance and time involved in attending the company office two days per week. This may be manageable through careful planning, batching of office days and possible discussion of travel/accommodation arrangements if required.
PEQ09 - What are your printing/scanning options (none / pay-per-use shop / own printer)?
Standard home-office printing/scanning options are assumed available for preparation purposes. In a live role, documentation should be handled primarily through secure digital systems rather than personal printing, unless authorised.
PEQ10 - If you had a small "starter kit" (phone + laptop + printer), who would be responsible for it?
For a live company role, the company’s IT and line-management arrangements would define ownership, issue, security and acceptable use of any laptop, phone or other work equipment. David Winter would be responsible for day-to-day care and compliant use.
PEQ11 - What does your workspace need to become functional (desk, chair, lockable cabinet, internet router, etc.)?
The home workspace is suitable for remote preparation and Teams-based work. For live work, the key requirements would be secure laptop access, reliable connectivity, Teams/Office access, risk-management software access, and any company security setup required for remote working.
PEQ12 - What would be the ideal operating base in 6 months (home office / shared centre / rented office)?
The ideal operating model in 6 months would be a hybrid arrangement: remote work from Essex for focused analysis and reporting, combined with planned attendance at project locations for workshops, stakeholder engagement and major PMO reviews.
PEQ13 - What security risks exist at your premises (theft, harassment, privacy exposure)?
For the illustrative PHC record, the main security risk is accidental inclusion of confidential information. The control is to use only public-domain or applicant-generated content. For live work, risks would include data security, device loss and unauthorised access, all to be managed through company policies and systems.
PQ01 - Who are the key roles today (leader, admin, outreach, finance, volunteer coordinator)? Names + roles.
For the illustrative PHC record, David Winter is the project lead and author. In a live company context, key roles would likely include the Head of PMO Major Projects, Senior Risk Manager, project managers, risk owners, planners, cost managers, change managers, environmental leads, engineering leads, commercial leads and external partner risk representatives.
PQ02 - How many are active weekly (not just "on the list")?
At the illustrative stage, one person is active: David Winter. In a live implementation, weekly active participants would depend on the selected project scope but would likely include multiple project managers, partner representatives, planners, cost/change leads and risk owners.
PQ03 - What skills do you have in the team (counselling, healthcare links, social work, advocacy, fundraising, admin, IT)?
The available skills for this illustrative record are project risk management, project assurance, action tracking, schedule risk support, governance reporting, database-style project control, stakeholder communication and PHC Service design. Live implementation would add the company’s internal engineering, environmental, planning, cost, commercial and PMO expertise.
PQ04 - What skills are missing that you need most urgently?
For live application, the most urgent missing inputs would be detailed knowledge of the company’s current Riskonnect/ARM configuration, NEC contract administration practices, internal risk taxonomy, project schedules, cost structures, regulator reporting requirements and partner-delivery arrangements.
PQ05 - What training would help most (basic safeguarding, data handling, case management, fundraising, reporting)?
The most useful training would be company induction, Riskonnect/ARM configuration and workflow training, NEC clauses relevant to early warnings and compensation events, internal PMO reporting standards, information security, regulatory reporting expectations, and the company’s programme delivery governance model.
PQ06 - How do you recruit and manage volunteers (screening, agreements, supervision)?
This question is not directly applicable to the illustrative company major-projects risk model. In a live setting, team members and external partners would be managed through formal employment, contract, procurement and PMO governance arrangements rather than volunteer recruitment.
PQ07 - Do you have a safeguarding lead / safeguarding rules? If not, who could be assigned?
Safeguarding in the humanitarian sense is not directly applicable. For a live company environment, relevant safeguards would include health and safety, environmental protection, information governance, data protection, security, procurement compliance and escalation rules. Responsibility would sit with the relevant company functional leads.
PQ08 - What is your communication rhythm (weekly meeting, WhatsApp group, ad-hoc)?
The proposed communication rhythm would include weekly or fortnightly project-risk reviews, monthly partner-risk updates, monthly risk-performance reporting, scheduled QSRA/QCRA review points, and exception-based escalation when mitigation actions are overdue or residual exposure increases.
PQ09 - What conflicts or workload risks exist (burnout, role confusion, disagreements)?
Likely people/workload risks include role confusion between PMO, project controls and delivery partners; overload from too many registers and reports; inconsistent partner engagement; pressure to understate risk; poor attendance at reviews; and burnout in a growing team managing a large programme delivery portfolio.
PQ10 - If funding arrived, which 3 positions would you pay first (and why)?
For a live governance pilot, the first three roles to resource would be: 1) Senior Risk Manager to lead framework implementation and risk discipline; 2) Risk Analyst/Coordinator to maintain registers, actions, evidence and reports; 3) QSRA/QCRA specialist or project controls analyst to support quantified cost/schedule analysis and integration with planning and cost teams.
FQ01 - Do you have any current income (donations, grants, sales, membership, events)? Rough monthly average.
This illustrative project has no separate project income. If implemented in a live corporate setting, funding would come through the company’s employment, consultancy, PMO or project-delivery budget arrangements.
FQ02 - What are your fixed monthly costs (rent, airtime, transport, printing, internet)?
For the illustrative project, fixed costs are limited to normal home-office and PHC Port development overheads. For a live role, relevant costs would include salary, employer overhead, software access, travel, accommodation if required, training, professional membership and normal corporate IT support.
FQ03 - What costs are unpredictable emergencies (medical cases, relocation, safety incidents)?
For this project type, unpredictable cost pressures would include urgent site attendance, additional workshop support, unexpected partner-risk deep dives, schedule/cost-risk rework, regulatory or environmental response activity, and short-notice travel or accommodation needs.
FQ04 - What are the top 10 things you spend money on when you have it?
In a live project-risk governance context, likely spending categories would be: risk-management personnel, risk analysts/coordinators, QSRA/QCRA support, risk software licences, training, professional membership, workshops, travel, accommodation, data/reporting support and PMO administration.
FQ05 - Do you keep records (cashbook, receipts, mobile money statements)? Who holds them?
For the illustrative PHC record, no separate financial records are required. In a live company context, financial records would be held through the company’s finance, procurement, HR and project-control systems.
FQ06 - Do you have, or intend to open, a bank/mobile money account in the organisation name? If not, what do you use?
No separate bank account is required for this illustrative project. Live implementation would be handled through the company’s normal finance, payroll, procurement and supplier-payment arrangements.
FQ07 - What is the smallest funding amount that would make a real difference this month?
For a live pilot, the smallest useful funding would be enough to allocate dedicated Senior Risk Manager and analyst time for a short diagnostic review of one major project or selected risk registers. In employment terms, the equivalent would be approval for the role, access to systems and authority to engage with project teams and partners.
FQ08 - What is your 12-month "ideal budget" (even if rough)?
A 12-month ideal budget would depend on scale. For a single-person permanent role, it would include salary, benefits, travel, training and software access. For a wider PHC-style pilot, it might include one Senior Risk Manager, one Risk Analyst, part-time QSRA/QCRA support, workshop allowance, reporting support and professional development.
FQ09 - What funding have you tried before (who, when, result)?
This illustrative company record is not currently seeking external funding. The relevant live route would be employment as Senior Risk Manager or an internally sponsored PMO/risk-governance improvement initiative.
FQ10 - What would you consider "good governance proof" to show donors money is safe (reports, receipts, photos, beneficiary confirmations)?
For this project, good governance proof would include current risk registers, mitigation-action logs, evidence of owner engagement, monthly partner-risk updates, QSRA/QCRA outputs, P50/P80 milestone data, escalation records, contingency-drawdown advice, lessons learned and concise management reports showing risk movement over time.
MQ01 - Who is your audience: donors, local community, government, clinics, schools, families, beneficiaries?
The audience includes company PMO and major-project leadership, project managers, delivery partners, environmental and engineering teams, planners, cost/change functions, regulators, local authorities, affected communities, customers and internal governance stakeholders.
MQ02 - What channels do you currently use (WhatsApp, Facebook, TikTok, radio, church announcements, community meetings)?
For the illustrative project, channels include PHC Port, interview materials and applicant-preparation documents. In a live company context, channels would likely include Teams, SharePoint, Riskonnect/ARM, email, PMO reports, governance meetings, workshops, dashboards and project-control forums.
MQ03 - Do you have any assets: logo, photos, short video, testimonials, case stories?
Available assets include PHC Port overview material, David Winter’s CV and cover letter, selected project-history examples, and public company/programme reference material. No internal company materials should be used unless authorised.
MQ04 - What is your "one sentence" message to donors?
For decision-makers, the one-sentence message is: PHC-style risk governance helps a major infrastructure programme turn risk information into visible ownership, practical mitigation, timely escalation and better delivery decisions.
MQ05 - What is your "one sentence" message to beneficiaries?
For customers and communities, the one-sentence message is: better risk governance helps essential water and wastewater projects deliver more reliably, safely, transparently and with stronger protection for service, environment and public value.
MQ06 - What questions do people ask most often about your project (and what answers do you give)?
Likely questions include: Is this an official company project? No, it is illustrative unless formally adopted. Does it replace existing PMO systems? No, it supports and strengthens them. Is it only a risk register? No, it links risks, concerns, actions, evidence, owners and reporting. Does it require new software? Not necessarily; it can work through existing systems such as Riskonnect/ARM.
MQ07 - Do you have a list of contacts (supporters / organisations)? How many?
Current contacts for the opportunity include the recruitment channel and the named interview context. Wider live contacts would need to be established through the company’s PMO, project teams and delivery partners if the role or pilot were implemented.
MQ08 - What partnerships would unlock growth fastest (hospital, police, school, local government, NGO)?
The partnerships that would unlock value fastest are internal PMO leadership, project managers, planning and cost teams, delivery partners, environmental specialists, engineering leads, commercial/NEC contract specialists, regulators and local-authority stakeholders.
MQ09 - What events could you run quarterly (awareness day, clinic day, school session, community meeting)?
Quarterly events could include major-project risk health reviews, partner-risk integration workshops, QSRA/QCRA lessons-learned sessions, opportunity-capture workshops, environmental-risk review sessions and PMO improvement retrospectives.
MQ10 - What proof would be easiest for you to publish monthly (numbers helped, photos of deliveries, short story, receipts summary)?
The easiest monthly proof would be a project-risk health report showing number of open risks, overdue reviews, overdue mitigations, partner updates received, risks quantified, P50/P80 milestones reviewed, emerging issues captured, opportunities tracked and management escalations closed.