| P1 |
ISO: ISO 9001:2026 launch |
the update "places greater emphasis on leadership, a culture of quality and ethical behaviour." |
| P2 |
ADP 6-0; COSO ERM |
ADP 6-0 principle: "Competence." COSO principle 5: "Attracts, Develops, and Retains Capable Individuals" |
| P3 |
PMI: PMBOK Guide 8; ISO 20400; ISO 14001 (catalogue) |
PMBOK 8 principles: "Adopt a holistic view, focus on value, embed quality, lead accountably, integrate sustainability, and build empowered teams." |
| P4 |
Directive (EU) 2019/1937; Deming; Toyota |
Art. 8(3): "Paragraph 1 shall apply to legal entities in the private sector with 50 or more workers." Recital 88: "A clear legal prohibition of retaliation would have an important dissuasive effect". Deming 8: "Drive out fear, so that everyone may work effectively for the company." Toyota: "the operator can stop the line by pulling the stop cord themselves" |
| P9 |
NIMS |
"The Incident Commander or Unified Command establishes objectives that drive incident operations." |
| P10 |
COSO ERM |
principle 8: "Evaluates Alternative Strategies" |
| P11 |
§ 239 HGB (dejure.org); GDPR Art. 5 |
§ 239(3) HGB: "Eine Eintragung oder eine Aufzeichnung darf nicht in einer Weise verändert werden, daß der ursprüngliche Inhalt nicht mehr feststellbar ist." (An entry or record must not be changed in a way that makes the original content no longer determinable.) GDPR 5(2): "The controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1" |
| P12 |
Flyvbjerg 2006 |
step 1: "Identification of a relevant reference class of past, similar projects." "inaccuracy in cost forecasts in constant prices is on average 44.7% for rail, 33.8% for bridges and tunnels," "and 20.4% for roads." |
| P13, P16, P77, P70 (part), P64 (part) |
COSO ERM |
principle names: 18 "Leverages Information Systems"; 8 "Evaluates Alternative Strategies"; 16 "Reviews Risk and Performance"; 15 "Assesses Substantial Change" |
| P14 |
OECD Due Diligence Guidance |
"This Guidance helps businesses to understand and implement due diligence for responsible business conduct." |
| P22 |
Klein: Performing a Project Premortem (HBR 2007); COSO ERM |
Klein: "In a premortem, team members assume that the project they are planning has just failed—as so many do—" and "generate plausible reasons for its demise." COSO principle 14: "Develops Portfolio View" |
| P23 |
Agile principles |
"Simplicity--the art of maximizing the amount of work not done--is essential." |
| P24, P36 |
GDPR Art. 5 |
5(1)(e): "kept in a form which permits identification of data subjects for no longer than is necessary" 5(1)(c): "adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed" |
| P25 |
Google re:Work |
dynamic 3: "Structure and clarity" |
| P28 |
WHO/ILO 2021; Pencavel 2014; Agile principles |
WHO/ILO: "working 55 or more hours per week is associated with an estimated 35% higher risk of a stroke" and "a 17% higher risk of dying from ischemic heart disease, compared to working 35-40 hours a week". Pencavel: "below an hours threshold, output is proportional to hours;" "above a threshold, output rises at a decreasing rate as hours increase." Agile 8: "The sponsors, developers, and users should be able to maintain a constant pace indefinitely." |
| P30, P37, P41, P76, P71 |
NIMS |
"Unity of command means that each individual only reports to one person." Management characteristics include "Modular Organization", "Integrated Communications", "Establishment and Transfer of Command". "IAPs represent concise, coherent means of capturing and communicating incident objectives, tactics, and assignments" |
| P31 |
Kohavi & Thomke 2017 |
"At Google and Bing, only about 10% to 20% of experiments generate positive results." At Microsoft, "one-third prove effective, one-third have neutral results, and one-third have negative results." |
| P32, P39, P55 |
Deming 14 Points |
9: "Break down barriers between departments." 3: "Cease dependence on inspection to achieve quality." "Eliminate the need for inspection on a mass basis by building quality into the product in the first place." |
| P38 |
Auditor Training Online: ISO 45001 clause 8.1.2 (secondary; ISO text is paid) |
"The organization shall establish, implement and maintain a process(es) for the elimination of hazards and reduction of OH&S risks using the following hierarchy of controls: a) eliminate the hazard; b) substitute with less hazardous processes, operations, materials or equipment; c) use engineering controls and reorganization of work; d) use administrative controls, including training; e) use adequate personal protective equipment." (clause 8.1.2 as reproduced in the article) |
| P40, P56, P26 |
IIA Three Lines Model (2020) |
"However, responsibility for managing risk remains a part of first line roles and within the scope of management." "Internal audit's independence from the responsibilities of management is critical to its objectivity, authority, and credibility." "It achieves this through the competent application of systematic and disciplined processes, expertise, and insight." |
| P56 (external) |
EU 537/2014 Art. 17 |
"…nor this in combination with any renewed engagements therewith shall exceed a maximum duration of 10 years." "The key audit partners responsible for carrying out a statutory audit shall cease their participation" "in the statutory audit of the audited entity not later than seven years from the date of their appointment." |
| P56 (red team), P46 |
UK MoD Red Teaming Handbook |
red teaming is "the independent application of a range of structured, creative and critical thinking techniques" "to assist the end user make a better-informed decision or produce a more robust product." |
| P45, P58 |
ISO TC 260: People power |
ISO/TS 30433 "describes the elements of succession planning metrics and provides comparable measures to report on them." |
| P44, P52 |
Little 2011 (reprint) |
see P52 |
| P47, P73 |
BCI GPG 2018 with ISO 22301:2019 definitions |
MTPD: "the time frame within which the impacts of not resuming activities would become unacceptable to the organization". RTO: "prioritized time frames as set within the time identified in MTPD" "for resuming disrupted activities at a specified minimum acceptable capacity" |
| P48, P66 |
Scrum Guide 2020 |
"No changes are made that would endanger the Sprint Goal;" "Only the Product Owner has the authority to cancel the Sprint." |
| P49 |
Parkinson 1955 (text copy; original in The Economist, November 1955) |
"It is a commonplace observation that work expands so as to fill the time available for its completion." |
| P51 |
Lee, Padmanabhan, Whang 1997 |
"Sell-through data and information on inventory status at downstream nodes are keys to improving channel coordination" |
| P54, P65, P68, P75, P30 |
Purple Griffon: PRINCE2 7th edition principles (secondary; the official manual is paid) |
principle names: "Ensure continued business justification", "Manage by stages", "Manage by exception", "Define roles, responsibilities, and relationships". On exceptions: "These exceptions are promptly escalated to the subsequent management tier" |
| P65 |
DORA: Working in small batches |
"Working in small batches is an essential principle in any discipline where feedback loops are important," "or you want to learn quickly from your decisions." |
| P76 |
Mark, Gudith, Klocke 2008 |
"people compensate for interruptions by working faster" "experiencing more stress, higher frustration, time pressure and effort" |
| P80 |
US Army: Foundations of the AAR Process (DTIC), quoting TC 25-20 (1993) |
an AAR "is a professional discussion of an event, focused on performance standards," that "enables soldiers to discover for themselves what happened, why it happened, and how to sustain strengths and improve on weaknesses". Table 3: "Minimizing 'finger-pointing'" |
| P81 |
Agile principles; Scrum Guide |
Agile 12: "At regular intervals, the team reflects on how to become more effective, then tunes and adjusts its behavior accordingly." Scrum: "transparency, inspection, and adaptation" |
| P82 |
CAIB report summary |
"the NASA organizational culture had as much to do with the accident as the foam that struck the Orbiter on ascent." |
| P83 |
Sedona Commentary on Legal Holds, 2nd ed. |
Guideline 1: "A reasonable anticipation of litigation arises when an organization is on notice of a credible probability that it will become involved in litigation, seriously contemplates initiating litigation, or when it takes specific actions to commence litigation." |
| P70 (go and see) |
Wikipedia: Genchi Genbutsu (secondary only) |
no quote checked |
| P15, P27, P29, P34, P72, P74 |
cross-reference only |
no management source found |
| P50, P67 |
section 9 sources (theory of constraints, critical path method); ISO 21502:2020 |
no new quote |
| P17, P33, P61, P59, P60, P78, P57 |
ISO catalogue pages listed in sections 4 and 10; for P61, the ASME page in section 9 |
catalogue pages give titles and summaries only; no requirement text quoted |