A risk free society?
The desire of many people is a risk-free society and the public points out to the government that it’s their responsibility. If something happens (a storm, a disaster, or an earthquake) it is governments’ fault. Buildings are not built well enough; there was insufficient monitoring et cetera. The government is constantly in the dock when it comes to these risks in life.
As a government, it is advisable to try to manage public trust. Explain to the public that you do everything humanly possible to avoid disasters, but that you cannot guarantee disasters will not happen.
The major risks in society at this moment are, in my opinion, climate change and rising sea levels, the increasing shortage of raw materials, regional conflicts, wars and terrorist threats, corruption and obviously the credit crisis. The impact of nature is a real threat to human life. In that context you have the risk of and the shortage of raw materials. People will increasingly feel the effects – for example the increase in population migration. The difference between rich and poor is widening and large scale migration could be a result. We need to think in scenarios to focus on this risk, for us to make the medium and long term risks visible.

As for risks closer to home, it is very useful to make a risk profile of a region. In this profile, vital infrastructure and all companies that pose a risk should be identified. It is the government’s responsibility to keep the risk within boundaries. All government layers play an important role in the safekeeping of a region. In the Netherlands we have 26 Mayors united in the Board of the Safety Region and we also have a regional police force. It is very important to never see safety as something isolated – it should always be integrated with everything else. Cooperation is very important in the safekeeping of a region. Vision and policy should originate from cohesion and cooperation and it is vital to ensure all 26 municipalities and the police work well together if they need to act. Cohesion is a very important word when we talk about risk management. Now the cooperation is fragmented. The police, fire services, health authorities, national government, the province and municipalities … everyone is busy with security. There are often not enough links. The role of mayors in the field of security is increasingly important. Some of them don’t know their responsibilities. Take Mexican (Swine) Flu for example. Many mayors do not realise that they are responsible. Another example: Many mayors do not know that there are 13 programs of the Ministry of Internal Affairs about safety. Public Health, Internal Affairs, laws from the central government, administrative measures in the context of promoting national security, anti-terrorism measures … These are all the Mayors’ responsibility. They often do not know and it is our responsibility to inform them.

The police, fire department, the Public Health Service, the State, the municipalities and county … everyone is busy with security. The consistency is sometimes hard to find. The role of mayors in the area of security is increasingly important. We have an important role in informing these mayors about the risk and the responsibility they have according these risks.

Disaster always occurs when you least expect it to. It is always inconvenient. As the Regional Security we try to plan ahead of these disasters by making the region ready for action and by pointing out the major risks to mayors.

The State of the art of Risk Management
The state of the art of Risk Management at this moment is the need to reduce complexity. Making things simple is very important, this makes it more easy to get down to the problem and work on solving that. Name the risk, work on it and close that chapter to start working on the next risk! PRIMO can make a real difference in the Risk Management world by making the Risk Managers think in scenarios and by letting them learn from each other’s best practices.

We should all work together in this, but in the same time try to keep it simple! Consistency is the key to success!

de nieuwe Collegeprogramma’s en de crisis: maatregelen, risico’s en risicomanagement

De bijeenkomst wordt verzorgd van 13.30 uur tot  17.00 uur in de Observant te Amersfoort.

Alle gemeenten staan voor de uitdaging om in de nieuwe collegeperiode fors te bezuinigen. Hoe groot de noodzakelijke bezuinigingen uitpakken weet nog niemand, maar vast staat wel dat de kaasschaafmethode niet meer zal werken.

In deze bijeenkomst gaan we uit van het scenario waarbij er 20-25% bezuinigd moet worden. Wat zijn dan realistische scenario’s om die enorme taakstelling te realiseren? Wat voor keuzes dienen zich aan. Welke risico’s brengen die met zich mee, zowel financieel als sociaal? En hoe kun je daarmee om gaan vanuit de invalshoek van risicomanagement.

Aan de hand van een aantal sprekers belichten we bezuinigings-scenario’s voor verschillende beleidsdomeinen. Daarna gaan we in werkgroepen verder in op risico’s en risicomanagement.

Reserveer de datum in je agenda en meld je aan bij: martijn.meijberg@minbzk.nl. 

Je ontvangt het uitgebreide programma bij aanmelding in januari.  

De kenniskring risicomanagement is een initiatief van het ministerie van Binnenlandse Zaken in samenwerking met diverse gemeenten, provincies en kennisinstellingen.

This situation offers many challenges and opportunites. It demands an alert and dynamic local government and adjustment of and reflection on old ways and on the future. In the meantime, local government elections are coming up on 3 March 2010.  Political leadership is now all important and its most important basis is adequate risk management.   

A requirement?
With the implementation of the Decree Budgeting and Rendering Account (Besluit Begroting en Verantwoording (BBV) in 2004, local governments are required to render account on some important fields of competence. Local governments have to pay specific attention to their financial capacity, take stock of financial risks, and formulate a policy for risks and stress capacity. This demands a dynamic and permanently operational system of risk management, because the state of the art has to be presented (at least twice a year) at the presentation of the budget and at the presentation of the financial statements. The objective of the regulator is to gain a better view of the financial position of local governments on a permanent basis.

What is risk management?
The BBV sets out the main definitions. We first explain these definitions.
Risks: a chance that an event occurs which will have a (negative or positive) effect on the continuity of operations and the realization of the objectives of the organization.

Control measures: the set of measures and procedures to deal with known risks or identify emerging risks and mitigate their effect.

Stress capacity: the sum total of resources and funds available for non-budgeted, unforeseen and possibly substantial costs. This capacity is measured for incidental and regular costs.

Stress test: the extent to which financial setbacks can be cushioned. This test compares the financial capacity against the risks incurred.

Risk management: the identifying and quantifying of risks and taking steps to reduce the chance of the risk occurring and/or keep the effects of risks within reasonable limits

The struggle
Since the implementation of the BBV, local governments struggled with the question how to give substance to the requirements in the stress capacity paragraph.  Some responses were ‘we cannot foresee everything, ‘we do not have a looking glass’, ‘many risks cannot be quantified’, ‘who should do what during the entire process and is accountable for identifying the risks?’

These are certainly relevant comments and questions. Yet, the stock taking of risks offers many answers. Although aimed at finance, taking stock of risks gives priority to the calculation of a quantified risk within a certain bandwidth. That is encouraging for a start. Moreover, if an organisation becomes aware of risks and the need to respond at an early stage, the benefit has been realised.

Three aspects are important: behaviour, awareness, and response. As we all know, changing behaviour is a difficult task. Below, we have made some suggestions.

A systematic and logical approach 
If growth and opportunities are our mission, uncertainties and risks are unavoidable. It is important that all parties acknowledge this fact and anticipate on it. It means identifying risks at an early stage, taking steps, learning in new circumstances and ensuring that our behaviour evolves. It is vital that there is a clear agreement on the phases of the risk management process between the municipal council, the municipal executive and the civil servants and that the accountability lines are defined.  

The risk management steps and their consistency may be illustrated as follows: 

Gemeenteraad = Municipal Council

Kaderstelling & Strategie = Framework & Strategy formulation

Verbetering = Improvement

College & Management Team = Municipal Executive and MT

Beheersmaatregelen = Control measures

Risicoweging = Risk weighting

Resterende risico’s = Remaining risks

Gebeurtenissen = Events

Weerstandscapaciteit = Stress capacity

Monitoren Resultaten = Monitoring and Results

Good governance 
In addition good governance has to be complied with. This is the framework of rules in relationships.

The four pillars in the Governance cycle are

Steering: Is it clear which risk profile the municipal council finds acceptable and on how the municipal council wishes to be informed on developments?

Control: Have steps been taken by the municipal executive and the top of the civil servants to enable risk identification and  risk management by management control and being alert for changes?

Rendering account: How and how regularly should individuals render account on the development of risks, the effects of new policy, the effects of non-foreseen risks, achievement of objectives, and compliance with regulatory frameworks?
Supervising: Is the risk management system evaluated for effectiveness and costs.

Ultimate aim

The reason that local governments want to take stock of risks is that they have to achieve social objectives. Risk quantification provides an understanding of whether the financial position allows new undertakings and gives an analysis of developments. In addition, it provides an impetus to reduce risks, so that objectives can be achieved within an acceptable risk level. It renders the organisation adaptive to the highest degree.

It is important or local governments to be able to respond to new circumstances caused by changing operations such as new joint ventures, regulatory changes, contract changes, or new policy implementation. This means that risks must be acknowledged and adequate provisions taken.  In these circumstances one needs a balanced mix of hard controls and soft controls. Hard controls can be described as measuring the achievement of targets testing compliance with regulations. The measuring is objective, as the targets are agreed within the organisation. Soft controls are a management control tool for measuring employees’ individual performances. These controls test motivation, loyalty, integrity, inspiration and the ethical principles of employees. A mix of both types of control gives the right balance.

Clear procedures and consensus

Besides a clearly defined risk management process, an adequate governance cycle, and a balanced mix of hard and soft controls, consensus and clear procedures are important ingredients for a successful implementation. We have a few recommendations: choose a risk management concept that suits your organisation. Ensure that individual employees in the line organisation are made accountable for estimating, managing and reporting risks. Consensus between the management team and the municipal executive for the concept is vital. Organise a knowledge session where the subject is discussed in-depth and the added value clearly illustrated. Start simply with a pilot. An essential basis for consensus is sound project management. Last, we recommend avoiding an additional workload on the organisation if possible, and using existing initiatives, concepts and systems. 

Final remarks

A sound implementation of risk management is not identifying a sum total of risks. Risk management is more than financial quantification and identification of risks. It is not a static once-only implementation effort. It is an important driver for realising targets, making the most of opportunities and developing an organisation. If the organisation’s own strength is carefully mapped out, the organisation remains alert and tools and working methods up-to-date. This method of working enhances trust and transparency. This is what we call leadership. 

F.A.J. van Kuijck RA RO EMIA en Drs. R.M.J. van Vugt RA – who are partners of Deloitte Accountants B.V.

 Managing risk is difficult. Applying risk management is more difficult. Implementing risk management in organizations is the most difficult. Failure is more the rule than success and large sums of money, seemingly invested in implementing risk management, are actually wasted. While many organizations struggle with this issue, there was hardly any scientific research about this topic. This article presents a scientifically developed and practically tested approach for implementing risk management in organizations. A synthesis of risk, innovation, and change management concepts and practices makes this approach new and unique.

The need for risk management implementation 
As anyone dealing with risk management experiences, risks are inherently subjective and intangible. Risk management is basically handling uncertainty, with which most people feel rather uncomfortable. Moreover, risk management has a preventive character. This means doing something to avoid something else happening. Unfortunately, often there is no direct relationship between application and benefits of risk management. Nevertheless, public organizations operating in our rapidly changing world are highly vulnerable to risk. Therefore, an increasing number of politicians, regional and local government chief executives and senior managers acknowledge that not routinely applying risk management cannot be justified anymore. It is unacceptable for the sake of our communities. However, embedding the application of risk management in an organization in an effective, efficient and persistent way is by far not easy. It is an ill-defined and messy problem. Perhaps, that is why there hardly existed any scientifically validated and practically applicable knowledge, about how to implement risk management in organizations.

Risk management implementation research
After many years of debates about why to apply risk management in organizations, the increasing need for adequate risk management implementation creates a new type of question:

How to implement risk management in organizations? 

This how-question seems even more difficult to answer than the why-question, which was the trigger to start in-depth risk management implementation research. The term implementation is here defined asroutinizing the application of risk management, at a regular basis and at all levels within an organization. Comprehensive literature surveys and field research have been performed. Academic and professional experts from The Netherlands, the United States, the United Kingdom, and South Africa, were in-depth interviewed. All of these results were used for the development of an entirely new risk management implementation approach.

The new risk management implementation paradigm

Soon after starting the research, a major problem emerged. The current state of our risk management discipline seemed not able to answer the how-to-implement question in a convincing way. Indeed, despite the availability of numerous risk management concepts, procedures and tools. This situation required a new risk management implementation paradigm, with a shift from an instrumental to an organizational approach:

Risk management is an organizational innovation that requires change.

This is merely because well-implemented risk management is new to most organizations, which is the key feature of an innovation. Contrary to the risk management discipline, innovation management does include a considerable knowledge base about implementation issues. Furthermore, the discipline of change management revealed abundant useful knowledge about creating the appropriate organizational conditions for implementing risk management in organizations. In conclusion, risk, innovation, and change form one fundamental triangle for risk management implementation.

Four main implementation lessons

The risk management implementation research provided four main lessons. First, the form, function and meaning of risk management within organizations are largely intangible and subjective. This makes effective, efficient, and persistent implementation a highly complicated adventure. Second, specific managerial attention to routinize the use of existing risk management methodologies in organizations is highly underdeveloped. A knowledge base of how to implement risk management was missing. Third, implementing risk management in organizations requires a well-designed, yet flexible and learning, approach. Appropriate organizational conditions need to be created by purposeful interventions in the organizational structure and culture. This calls for a synthesis of proven risk management, innovation management, and change management concepts and practices. Fourth, any risk management methodology needs to be adapted to the demands of distinct groups of risk management users. They have different types of motivation, or no motivation at all, for routinely applying risk management. The first two lessons confirm the mentioned ill-defined and messy implementation problem, for which the last two lessons provide solutions.

Four practical research products

The developed and tested research products are two models and two instruments. The conceptual model presents the main mechanisms for effective, efficient, and persistent implementation of risk management in organizations. The three dimensions of the model are (1) risk management users, (2) social systems in organizations, and (3) risk management methodologies. The design process model  has been developed for context-specific design of risk management implementationprocesses. The model distinguishes the feasibility phase, the explicitdecision phase, and the execution phase. Moreover, it defines roles, tasks, and responsibilities of all actors during the risk management implementation process. The audit instrument allows measuring the degree of implementation readiness of organizations. In addition, it measures implementation progress over time. The audit instrument consists of three questionnaires. Completed questionnaires reveal the differences in individual implementation perception of actors before, during, and after the risk management implementation process. Finally, the intervention proposition assists the selection of adequate key interventions with supporting activities. These purposeful actions aim to increase the degree of motivation and commitment of distinct groups of risk management users. All of these research products incorporate the synthesis of proven risk, innovation and change management knowledge. The use of these products aims to professionalize the design, preparation, execution, and monitoring of risk management implementation processes in organizations.

Final remarks

Currently, the research results are successfully applied in a number of Dutch public organizations. Using the developed approach contributes considerably to more effective, efficient, and persistent implementation of risk management in a variety of organizations. This generates individual and collective benefits. For individual employees at different organizational levels, improved risk management implementation raises their efficiency and job satisfaction. For public organizations, fostering more professional implementation processes reduces implementation costs and increases accountability. In conclusion, professionalized implementation increases the material and immaterial benefits of routinely applied risk management.

For more information, please contact Martin van Staveren by e-mail: martin.vanstaveren@deltares.nl

According to Dick Maaskant, Business Controller of the municipality, this decision was influenced by several internal and external forces. For example, risk management had become a political issue not only due to the rise of principles of governance but also due to new legislative reporting rules concerning risk control within annual reports and budgets. However, of even more importance , was senior management’s growing consciousness that risk management should be an important tool in achieving strategic and operational goals.

Back in 2006, risk management in Roosendaal was not embedded within the organisation’s mainstream business. No policy, standard procedures or systematic approach towards risk management were available. When projects were being discussed, there would be a question of identifying risks during the decision stage but this had little impact on the outcomes. There was  reluctance to talk about risks arising, mostly out of fear for their inhibitory effect on the acceptance of new initiatives. Discussing risks was not part of business culture – in reality a pretty risky situation.

City Manager Jack Kruf and the Board of Mayor and Aldermen, pushed for the integration of risk management into existing business practices by laying out their aims and objectives in its  four year activity program.  Accordingly, the Board  allocated a substantial budget to facilitate the required process to establish  this goal.

Dick Maaskant became the Project Manager and at  the end of 2006, his proposal was approved by the Board.

The project approach was based on the following insights:

-          Whilst tools and sufficient management / employee technical skills are important in developing risk management, risk awareness and changing attitudes / behaviour towards risk management are equally so. This is a precondition for the successful implementation of risk management;

-          On the scale of a city such as Roosendaal, integrating risk management into business processes is a matter of  making  small steps which will take several years to be accomplished: a multi phased approach was required;

-          Top-down implementation is necessary: The tone at the top is essential for changing behaviours.

The project plan was scheduled to run for a period of three years.

During  2007, the  year the project started, the focus was on developing risk awareness at the managerial level ie.   The Board,  top management, departmental managers and project managers. Several workshops were organised to demonstrate the added value of risk management,   including themes such as ‘how can risk management contribute to decision making processes on a strategic level ?‘ and ‘how can  risk management contribute to the control of operational goals?’.

Risk analysis sessions, conducted in conjunction with various external agencies, were also carried out.  Analysis of  a real estate project ( new school ),  the introduction of  new  legislation around  social services at  local level and on a process design for a new way of communicating with neighbourhoods about improving their environment took place.

In addition a quick scan of the main operational risks and their effects on required reserves was carried out to  meet the reporting rules requirements regarding  2008 budgets

Year two was a year of investing in the education and skills of employees. Initial focus was on risk management processes –  how to identify,  analyse and quantify risk, and how to  implement  and evaluate control measures

Following this exercise all department managers were asked to make an analysis of the 10 main  operational risks in their area of responsibility . A software tool to systematically register their performances on risk analysis was made available. This software system includes a statistical function (Monte Carlo analysis) which can calculate  the level of financial reserves  needed to cope with the overall financial risk that Roosendaal is exposed to. The amount of reserves required  for  this purpose is based on the degree of certainty chosen in relation to the required  adequacy of reserves. On this, a policy was agreed with the Municipality, also resulting in estimating a minimal performance value at a ratio expressing total amount of financial risk related to the financial reserves ofRoosendaal. That ratio is called the ’risk resistance ratio’.

With regard to  risk ownership, a manual was created which included procedures on reporting and  managing risks. Department managers are the initial risk owners but depending on the potential financial impact of a risk or its control measure, the risk has to be reported and shared with higher management levels. The basic rule is that the higher the financial risk, the higher the managerial level  involved.

In the last year of the project  (2009) the focus is  on integrating risk management into the mainstream business. Risk management is introduced as an activity in the subsequent project phases for large projects, risk management is applied to risk management processes. Risk management accountability is secured in the planning and control process, both in the annual program budget and report as internal accountability and reporting to senior management and the Board.

According to Dick Maaskant “As we near the end of the project have I think our views at the beginning of the project have proved correct. There has been a significant investment of time and money but we have achieved our goal in that t risk is now on the agenda for  not only  the administration and management in general but also  the wider employee base. Risk awareness has improved and we have developed a systematic way of working to deal with risks. We have integrated risk management into our business. Understanding of the risks we run has been improved, which also results in a less tense atmosphere when we talk about risk.”

But we can also make further steps in the future. Discussion about measures concerning risks can still  become more indepth and require more attention. Our risk perception should not be limited to incidental or financial risks.  We still need to expand into other risk categories such as legal , environment , political and strategic risk to further grow awareness . But, the foundation is there.

What is Risk Management?
Often, risk management is perceived as emergency planning and fighting disasters. One of the greatest risks facing society at this moment is, of course, the financial crisis. However, we are also facing natural disasters such as earthquakes and flooding. Global warming is causing sea levels to rise thus creating an increased risk of flooding and breaches of coastal defences . Water levels can  rise, but the water cannot  go  anywhere due to our dikes. Sea levels are also rising, therefore we should make the dikes even higher, which will make it impossible for the inland water to get out.
Generally risk management is  about taking precautions to  understand risks can occur, to make sure you calculate those risks and do anything possible to mitigate them. Another significant risk at this moment is  pandemic flu. For example more victims fell to the Spanish flu outbreak early in the twentieth century  than during the First World War. To limit the number of victims it is necessary to take precautions,  such as  vaccination. But even with these precautions, there is a chance that one third of the population will become ill. When this happens the other two thirds of the population will have to ‘cover’ for them. This means less police, less fire fighters, less doctors and nurses…
It is important to prioritise, to choose what is important. We plan ahead and make our priorities clear before the pandemic is at its worst. We call this our Business Continuity Plan. Local governments play a very important role in these decisions. Only they can decide what is important at a micro level.

The art of risk management
The most important thing in risk management is to be prepared. In Belgium we work with the security chain. Pro-action, prevention, preparation, risk control and care. In pro-action, there will be no risk. Pro-action means that you make sure the risk will not occur. For example: When the greatest risk in your house is falling down the flight of stairs, you will remove the stairs and with that remove the risk. Pro-active thinking forces you to think about the risks, during the planning phase. You can predict what is going to be a risk and make sure the risk is excluded.

For example: if the dike breaks, within a few hours a whole area will be flooded. Knowing this, dictates which precautions you should take. In history they just didn’t build houses in areas that could flood. We should try to learn from that and try to be more pro-active.
 

The complexity of risks

The complexity of risks has increased over the last decade. It is a vulnerability paradox. If you compare our society with 15 years ago, we are now much better prepared than before. But we are also far more dependent on our facilities. There is a huge increase in technological complexity which increases the complexity of our risks, but on the other hand, this technology also helps us in controlling our risks. In the case of a failure  in technology, a high number of our processes will be down. Take for example the internet; if the internet is down, most of our communication is blocked. If electricity is down for an hour, we are in a huge panic. We are largely dependent on technology!

We are more and more aware of all the risks around us. The media plays a big part in this. When a risk occurs the media is all over it. The government is expected to make all the risks disappear. But we can not do this. We do everything we can, but we also don’t have all the answers and solutions.

There are four important things regarding Risk Management. You should:

• - Be prepared
• - Develop procedures
• - Be flexible with these procedures
• - Be pragmatic.

Preparation is the first step, just to think about reacting to an incidents. Make a structure plan, with the headlines in it, some kind of procedure.  Make sure that when the incident occurs you still have time to make decisions at that moment. Be flexible at decision time. It is impossible to plan ahead for disasters, you can never foresee what is going to happen.

You cannot plan risks. There is always the possibility that a risk  will occur; the world is an unpredictable place. You can plan ahead to fight the risks, but you can not plan the risks themselves.

Currently, society is exposed to threats on an international scale from the possibility of flu pandemics, climate change, terrorist attacks, the collapse of banks and manufacturing industries, and many other demographic changes. Clearly, there are few parts of the world that can avoid experiencing the impact of such events in their own backyards. The environmentalists’ plea to ‘think global, act local’ is one that local government, national government departments and other public service agencies are now actively addressing3.

The current swine flu pandemic is an example of how good preparation, based on past experience (in the case of the UK, through previous threats such as avian flu and crises such as foot-andmouth disease) and the lessons learned about how best to communicate with and protect the public, has led to a swift government response that will hopefully mitigate the spread of this disease and avoid a full-scale epidemic.

Issues of business and service continuity are now in the spotlight with many organisations adjusting their own plans to deal with a worst case scenario – and all this at a time when the financial situation demands ‘doing more with less’. For the frontline public services in particular, there is no doubt that effective risk management is essential in these challenging times.

With an increasing emphasis on efficient use of public funds, the reality of budget cuts and Government pressure on local government and other public service organisations to work in partnership with one another, another issue – that of procurement, and the risks associated with this operation – has been much to the fore.

In 2005, it was estimated that the UK public sector was spending over £100 billion each year on the procurement of goods and services, while in 2007, local councils in England alone were responsible for around £40 billion of public procurements. Such processes are strictly regulated by UK and European Union law and failure to follow accepted guidelines can lead to legal challenges. But legal threats are not the only problems facing public service organisations in their efforts to achieve best value for their clients, and from the public purse.

A group of Alarm risk managers and procurement specialists were asked to consider the threats faced during the procurement process and the risk management strategies that might be employed to assist the organisation in achieving its strategic objectives.

The following actions were considered useful in helping mitigate many of the threats, including:

• Clear linking of procurement and strategy

• Easy access to comprehensive, good practice advice / toolkits

• Making best use of technology with regard to records / tender documents

• Collaborating with other organisations

• Actively promoting the procurement service

• Recruiting and retaining procurement staff

• Training procurement staff, and

• Monitoring the process

Whilst public service organisations are well acquainted with the key requirements of procurement policy and law, there appears to be some diversity in both experience and approach towards strategic and operational aspects of the process, as well as the management of any threats that may arise.

Some organisations have produced detailed strategic guidance documents, others have developed leaflets for all employees who might be involved in procuring goods and services, yet others have broken down the procurement process into a wide range of specialist topics and published separate guidance booklets on each of these.

Whatever the strategy adopted, it is fairly clear that governments both in the UK and across Europe will continue to expect more efficiency in the use of public funds. Faced with the global threats that exist today, the solution lies not only in having the correct resources to hand, when needed, but also in ensuring that the risks relating to large scale public procurements are effectively managed.

Research Headlines

On the question if the economic downturn has raised the importanceof risk management 56% of the participants respond positively. “We are anticipating that the greater incidence of job losses, house repossessions and greater indebtedness in the population place (will) increase strain on housing and social services. So we think there will also be greater budget pressures. And we also think there is morelikelihood of contractors failing leading to loss of supply. We think there might be a greater risk of fraud in benefits and grants systems” says a Risk Adviser from the United Kingdom.

Asked to rate various risks, participants say the four most significant over the next 18 months will be environmental risk (73%), public liability (65%), business continuity (63%) and partnership risks (59%). In addition, almost as many participants are concerned about PPP and PFI associates or contractors (51%) as are concerned about citizens (54%). These two results illustrate how the downturn – combined with court rulings and regulations such as the EU Environmental Liability Directive2 – are adding to public entities’ long-term liabilities and making it increasingly difficult for them to genuinely share risks with the private sector. Over half the participants (56%) say that, because of the downturn, risk management is now seen as more important at senior levels in their organisation. A similar proportion says that the downturn has prompted their organisation to review its approach to risk management. And 22% say their board’s appetite for risk has grown. The proportion saying appetite has diminished (25%) is the smallest in any of the seven sectors in our survey. To the question if a sector-wide standard for risk management would benefit their organisation; Almost three-quarters (71%) of participants respond that a sectorwide standard for risk management either would or already does benefit their organisation. Of those already covered by a sector-wide standard, 89% say it benefits them. Currently, however, only 40% of participants say they have initiatives for evaluating their risk management practices against those of their peers.

Marsh recommandations:

Raise risk management to the position it deserves Public-sector organisations that have not yet formally incorporated riskmanagement need to do so. Risk management can be embedded bytraining senior executives. A dedicated risk manager will keep track ofrisks across the whole organisation and liaise with all the departmentsinvolved. The CEO should create a risk committee or a risk management group. Optimize risk retention and risk transfer. This should be a significant help to local authorities in optimising theirinsurance programmes by means of arbitrage between self-insuranceand risk transfer. There should be a direct return on investment in risk management, in terms of reducing the total cost of risk, and hence the cost of retained risks. Create a Europe wide public-sector risk management standard As an example, in conjunction with PRIMO France, Marsh is in the

Process of designing a Risk Management Label for public Entities, which aims at evaluating risk management practices of medium to large local authorities. Better risk management practices helps to protect citizens, improve attractiveness to stakeholders, improveaccess to public funding and also helps in reducing the total cost of risk by improving access to insurance. If you would like to receive a copy of the complete report, please send an email to the following email address: Sabrina.boshuizen@marsh.com

By Robert ‘t Hart

“When a municipality doesn’t have an effective form of risk management, it doesn’t have an effective management.” Since this argument was first introduced in England, it has been cited in many articles. In the United Kingdom the emphasis lies on the relationship between governance and risk management. Because of the risk culture and the presence of manuals, lessons can be learned from English practice. These factors of success can inspire other European public managers in improving their risk management.

In the UK the central government judges the municipalities with performance indicators with an analysis, the Comprehensive Performance Assessment, or CPA. This assessment has two purposes. Firstly the assessment examines if the policy objectives are achieved. Secondly it examines the management and business processes.

An important part of the analysis is the extent to which risk management has been embedded in the organization. This determines the quality of decision making and the quality of the management of the financial reserves. Since CPA is regarded as the standard for good municipal governance, a poor performance in the analysis means a major loss of image, because the outcome of the analysis of every municipality will be made public. It can also mean that subsidies provided by the central government can be reduced and that they will take administrative measures.
The most important principles that the CPA provides, have been converted by different organizations for some years into fully tailor-made manuals for municipalities. From the manuals 3 lessons can be learned.

1. Create a risk management vision from within the board. In England risk management is regarded as a management tool, it concerns the control of the entire organisation and the policy performance. The objectives of risk management are established by the City Council. In the Netherlands politics only interfere in abstract terms. Money is spent on risk management, but the council doesn’t fully understand what it is and what it can mean to them. This can result in risk management quickly disappearing from the political and administrative agenda.

2. Organization-wide approach instead of a singular approach.To insure an organisation wide approach, the MT is responsible for the entire risk management process. One of the tasks of the MT is to ensure that risk management is accepted by other managers. Subsequently the departments have to effectuate the risk management. They focus more on human error, process flaws rather than purely financial risks.

3. Clear mandate and responsibility.
In England the City Council only focuses on the most important, often politically sensitive risks. The control of other risks is often delegated to service and department managers. The benefit of this is that the board can actively participate in risk management, without being at the same time overwhelmed with information. On the other hand the MT does not interfere with department managers in the management of smaller risks. To organise this approach the MT, colleges and councils have to take the initiative.

Robert ‘t Hart is director of the “Nederlands Adviesbureau voor Risicomanagement” (Dutch risk management consultancy bureau).

“Considerable behavioral research suggests that the further away in both space and time a prospective risk seems to be, the less likely we are to take action to address or mitigate the risk itself. As Elke Weber puts it, “Personal evidence of global warming and its potentially devastating consequences can be counted on to be an extremely effective teacher and motivator. Unfortunately, such lessons may arrive too late for corrective action.” And even if they arrive early, we are resistant to learning. From Nassim Taleb’s observation that highly improbable events have disproportionate impact, making risk and uncertainty very difficult to calculate, to Philip Tetlock’s studies showing that social science experts are no better at prediction than their ignorant peers, there is ample and increasing evidence that even disciplined, scientifically trained human minds are deeply biased. We believe what others believe, what confirms our prejudices, what lies between two more extreme choices. We prefer what is more easily available – we really do prefer the bird in the hand over the two in the tree – and we are more reluctant to surrender what we have than to acquire what we don’t have. We penalise action more than inaction, even when the results are the same. We are, in other words, deeply and irredeemably human.

And this is before we have added politics to the mix. Before we have taken at all seriously the impact of group dynamics, political competition, collective identities and interests, institutional structures, the rules of the game and much more that shapes, perhaps distorts, public discourse and debate.

Yet public policy – that is, decisions made by governments on behalf of (and, let it be remembered, at the expense of) their constituents – require transcending the increasingly evident human frailties associated with risk and uncertainty. We cannot discount the risk of improbable but catastrophic developments, yet even the best data and most sophisticated models have yet to provide correctives for our human frailties. The future is translucent in part because we systematically cloud the lens through which we peer at it.

The scientific community knows this all too well, and it reacts to calls for clear and unequivocal prediction with characteristic diffidence. Glaciologist Robert Thomas has observed that “most scientists don’t want to, but I think we need a way to explore the extreme end of the range of possibilities.” In the absence of scientific consensus about both the facts and their social meaning, Michael Oppenheimer, the geoscientist who directs Princeton University’s Program in Science, Technology and Environmental Policy points out that experts typically “give a different view of the probability of various outcomes” of climate change impacts, further confusing the general public and the policymakers who are responsible for designing responses. The continuing doubt and uncertainty regarding the science of climate change
may have been, as Corbett and Durfee suggest, “a deliberate, well-financed tactic by oil and coal companies and conservative politicians in an attempt to undermine public confidence in science and thereby defer action against global warming” but it is also a reflection of the challenge that policy making confronts in an era when frail human judgment collides with virtually unlimited information.

Click here to read more about the WRR lecture 2007 

The Netherlands Scientific Council for Government Policy (Wetenschappelijke Raad voor het Regeringsbeleid, wrr) is an independent advisory body for Dutch government policy. The Council focuses on policy issues with long term social, economic, technological and political significance, which, as a consequence, transcend the policy domains of the various ministries. Members of the Council are highly qualified academics, appointed by the government for a period of five years. The wrr is an independent
think tank; it directs its own research programme, which is funded from the budget of the Prime Minister’s Office.

The annual wrr lecture offers policy makers and academics a high profile opportunity to discuss current policy issues with long term relevance for Dutch society. Kees Schuyt, Bruno Latour, Jan Peter Balkenende, Wim van de Donk, Anton Hemerijck.