https://riskacademy.blog/lessons-learned-4/