On the state of public risk management

Presentation by Jack Kruf with co-presentation by Leen Paape | March 2021

Jack Kruf

What have we learned from 2020? A reflection as a farewell lecture. Farewell. I felt a bit of resistance whilst shaving this morning. I’m not really one for goodbyes. But anyway, here I am.

This will be a plea to give the field of public risk management a boost. But answering the question? That’s not so simple. Geert Mak said it at the launch of his book Great Expectations: “Interpreting history isn’t easy when you’re still in the thick of it.” 

With many friends and colleagues watching on TV, and with my family here at home. It’s lovely to have you all here. I’ll try to shed some light on things. Together with Professor Leen Paape. An honour. It will be a three-part series, taking turns. Three questions are central, followed by a brief conclusion:

• What is the issue at the start of 2021?
• What is the intervention?
• What is the associated governance?

Leen Paape

Professor at Nyenrode following a career that alternated between the public and private sectors. Started at the Military Academy in Breda and, after the Ministry of Defence, briefly worked at KPMG, then KLM, PwC and finally Nyenrode. I have served on an Audit and Risk Committee for the Municipality of Rotterdam and the Ministry of Infrastructure and the Environment, and I now oversee an insurer, a pension fund and a large school organisation. 

My driving forces are accountancy, risk management and corporate governance issues. I have seen quite a few things go wrong and would like to help prevent that from happening.

.Jack Kruf

Risk management is about diligence, effectiveness, and precision all rolled into one. A noble profession. PRIMO was founded in Strasbourg in 2005. Its aim: to bring the issue of good public governance to the table, drawing on the practical experience of municipal secretaries across Europe, with a view to improving it. Risk management was part of that.

A year later, it was launched in the Netherlands by the VGS (i.e. the Dutch city manager association) with support from the Ministry of the Interior and Kingdom Relations (BZK) and BNG Bank. With Denmark, Sweden, the UK, France, Flanders, and Malta, we got off to a flying start in 2005/2006. 

For me personally, two strands come together here: taking good care of the city and managing taxpayers’ money effectively. 

1. What is the issue?

Jack Kruf

It’s been quite a year. 2020 is a special year. Firstly, because alongside my grandson Sam, my grandson Sebas has also joined our ranks. They are both open, honest, perceptive, and wise young men. With our already energetic granddaughter Equoia (code name) due in August, looking after their future is more important than ever. From that perspective, there is work to be done.

The recent Global Risks Report is subtitled: A Fractured Future. The report cites failed governance as a cause of risks. It is not a cheerful report. But it is realistic and honest.

What does our network of local authorities, water boards and provincial authorities have to say about this, alongside partners such as UDITE, Zurich, FERMA, Harvard Business Review, Marsh and Alarm? What lessons can be drawn from the Risk & Resilience Festival with the University of Twente and the ‘Results in Times of Transition’ course with Tilburg University? 

They all point in the same direction: we will need to become more effective in our governance: climate, energy, cyber, the circular economy, the social domain, COVID-19, the decline of nature, and a reliable government. There are many inefficiencies in our governance.

I quote the words of Municipal Secretary Hans Krul in his Professor Roelof Oldeman Lecture a year ago: “We can safely say that the government’s adaptive capacity is insufficient. Watch the news, and you’ll inevitably feel depressed. Youth care, the tax authorities, the police – every major form of public service seems to have serious shortcomings and is under scrutiny. This puts the much-needed public trust in the government under pressure, and that should be a cause for concern for everyone.”

The functioning of our political system plays a major role in this. According to citizens and businesses, it is the government that ultimately causes the risks, whilst they believe they are in control.

In 2005 in Copenhagen, 120 municipal secretaries concluded that 12% of policy is implemented and that 25% of that was effective. For the mathematicians among us, that brings the effectiveness down to 3%. It is not scientific proof, but it is a strong indication of what is going on at the edge of politics, government, and society.

Senior civil servant Bernard ter Haar of the General Administrative Service said this week in the FD: “A lot of policy is being made that we don’t know whether it works:” 

PRIMO research shows a significant gap between the ambitions of the administration and politicians and their capacity to deliver. In response to the question ‘Do you have enough money to bring your project to fruition?’, on a scale of 1 to 10, 4.62 on average, with a standard deviation of nearly 2.95 and a median of 3.0. Half of the 425 respondents scored below a 3. It left me speechless. I thought: What?

Paul Hofstra, Director of the Rotterdam Audit Office and winner of the 2019 PRIMO Award, comments on this in the report ‘Public Value Under Pressure’ – an overview of 12 years of audit reports in Rotterdam…: “On more than one occasion, ambitions proved to be unrealistic and risks were insufficiently recognised. In policy management, there was often too little attention paid to ‘soft controls’. Policy frequently proved to be compartmentalised into sub-processes, in which the social objective became lost. The Audit Office advocates for more administrative reflection beforehand and for a different management model, one that is more in tune with the everyday reality of practitioners and citizens.”

The discipline of risk management is in an early stage of development. There are 100 definitions and many systems in circulation, with just as many products and services. A common language is lacking. And public risk management, focused not so much on public organisations themselves as on societal issues, has only just emerged. The problem is that the complexity of the issues is not keeping pace with the prevailing management paradigms. A finding from our course with Tilburg University and TIAS.

Finally: the issue of Covid-19. It is complex – epidemiologically, ecologically, and economically. In my view, it is not a foregone conclusion, even with vaccines on the horizon. What I do know is what 2020 has taught me: being together, a cup of coffee or a glass of wine on a terrace in the sunshine, enjoying a nice meal out, cuddling – we call it ‘Kruffelen’ at home –, enjoying nature in our own country, actually meeting colleagues, celebrating Christmas together, playing with your grandsons.

There is this immense sense of positivity within me that can handle all these issues: we are at the dawn of a renaissance – a rebirth – of personal and public values. Just as Florence emerged from the dark Middle Ages in the 15th century with new energy, creativity, and innovation.

Leen Paape

Yes, for those who, incidentally, think that things are going much better in the private sector, I can either reassure you or, of course, disappoint you. We have now gone through some 50 years of neoliberal thinking and practice, during which the public-private balance has changed radically. Some, therefore, say that the public sector has been eroded in favor of the private sector, and there is certainly a grain of truth in that. Privatisation was the order of the day because the market was, after all, a much better mechanism for managing risks than the government – or so they thought. The rise of the private sector was accompanied by an increase in global inequality, the depletion of Mother Earth and her natural resources, and environmental pollution on an unprecedented scale.

The pandemic we are currently experiencing has shown once again that, as Dirk Bezemer so aptly put it, we have become a nation of small buffers. In the business world, too, we were found wanting.

No buffers, no adaptive capacity, and we are all living off the public purse – that is, you and me. Was the pandemic included in the scenarios? I ask this regularly, and the answer is almost always no. This is strange because a pandemic has been on the radar of our National Security Monitor for years.

One similarity between the public and private sectors is this: things usually go wrong in companies when there is no proper connection between those who make promises and those who deliver.

In the public sector, we saw this again in the parliamentary inquiry into the child care allowance scandal. Since Kok, civil servants and politicians have been barred from speaking to one another. Silly. Furthermore, a strict separation was once devised between policy and implementation – you know, the promise-makers and the doers. Also silly. Bernard ter Haar rightly hits the nail on the head.

For a carpenter, every problem can be reduced to a hammer and a nail. For this professor of corporate governance, therefore, every problem is a governance problem. Governance is often out of order; driving forces and counterforces do not speak the same language or sit at the same table, even though they really ought to.

2. What is the intervention?

Jack Kruf

Frank Dietz, PBL, 1st Oldeman Lecture outlines the complexity of the intervention at hand: “The concepts of sustainable development and the circular economy are linked to major societal challenges, such as reducing pressure on nature and the environment, the security of supply of crucial raw materials, the continuity of the food supply, a healthy financial system, good care for the elderly and people with disabilities, a future-proof energy supply, and so on.”

The intervention is to appoint a steward, an envoy, a steward, a tsar, or a commissioner with executive authority and funding for each issue. A form of program management, therefore, in which the line organisations follow the program objective.

An intervention is zooming out. Constant reflection on trends and developments outside and one’s own capabilities within: knowledge, skills, style, and character. All participants in our meetings express this need. Time for reflection is necessary to assess one’s position amid high dynamics and speed. After all, you need to know where you stand. Reflection is the way. Guided and managed.

An intervention is education:

• In terms of subject matter: a focus on how our system really works. 
• In terms of science: In addition to public administration, attention is also paid to social psychology, mathematics, ecology, ethics and anthropology, amongst other subjects. 
• In terms of the link to practice. Noam Chomsky on this: “Teach people what tools are available and let them use them to seek and find the solution themselves.
• In terms of collaboration: Psychologist Legoff works in teams of three. Each has a distinct role: supplier, architect, and constructor. The roles rotate during the project. This fosters mutual understanding, respect, and, above all, exceptional results.

In the field of public risk management, our own training/coaching programme, Kaleidoscope, is an example where science, technology and knowledge converge. This also applies to the successful course run with TIAS and Tilburg University, in which practical experience, subject-matter expertise, and scientific knowledge come together to tackle concrete challenges.

Finally: The intervention is the rebranding of risk management. The discipline does not resonate with directors and senior managers. Risk has a negative connotation. So let’s stop managing risks and switch to precision, value creation, credibility and reliability.

If we want public leaders to embrace the discipline, then the benefits of this noble profession must take center stage, not the risk. There’s work to be done for our marketing department, I’d say.

Leen Paape

The goal determines the behaviour of the system, so the best intervention you can make is to ask again what the goal is. That not only changes the behaviour, but it also provides focus. A good example is Dopper. Some time ago, I heard Dopper’s CEO on the radio and, when asked how his company was doing, the answer was ‘not so well’. The interviewer said, surprised: ‘How is that possible? I see Doppers everywhere in abundance.’ The reply was: ‘Yes, that’s the problem. My goal wasn’t more turnover and profit, but less plastic, so I’m drifting further away from my goal…’.

When you choose a goal, you naturally hope it’s one that appeals and motivates. These days, the word ‘purpose’ is popular; it has to be about something and inspire. But above all, I advocate for companies that are aware of their social role and responsibility; they must behave as corporate citizens. Feike Sijbesma, until recently the CEO of DSM, put it so well: if, as a company, you do not contribute to society, then you must ask yourself whether you have a right to exist. Wow.

That said, during my time as a consultant, it became clear that risk management in most companies rarely went much further than navel-gazing once or twice a year and conducting a risk inventory, with the exception of the financial sector – though, admittedly, that sector worked with models that certainly proved far from infallible. On the contrary, they created new risks, and we have since come to know the term ‘systemic risk’.

At this point, systems thinking is sorely needed. Systems are a collection of various components that aim to achieve something together. They possess a certain complexity in which simple rules lead to emergent behaviour and where self-management must be given space. This means that if you want to make an organisation adaptive, the workplace must offer the space to adapt to the needs of the context. The context has a major influence on how people and organisations function, so it is important to answer the question: ‘What is going on here?’ Yes, as Jack says, zooming out is important for that.

It always surprises me how poorly defined objectives are, even in companies. There are often too many of them, and they are ambiguous. Within that multitude there are always many ‘polylemmas’, to quote Robbert Dijkgraaf, and these are not easily resolved.

The government is no stranger to this either, and when I was still just about in the ARC of the City of Rotterdam, the new coalition agreement was published with 11 aldermen and some 80 objectives, all of which were supposed to be achieved within four years. That’s never going to happen; yes, a few will be achieved, but certainly not all of them.

Simply navel-gazing a few times and ticking off lists is, of course, not risk management; if you want to achieve that, it really needs to be embedded in everything that happens within an organisation. So yes, a significant upgrade is needed on that point too. Bernard ter Haar has a point here as well: reflection happens far too rarely.

3. What is the governance? 

Jack Kruf

Based on 15 years of round-table discussions and knowledge exchange, we have identified five elements of governance which simultaneously and significantly contribute to success and – if insufficiently present – to major risks:

• Is there enough funding, and are the rules manageable?
• Do we know who the target group is and do we understand their needs?
• Is leadership in order?
• Do we have the knowledge and techniques?
• Do we know what is happening in the wider context and who we need?

These five elements of governance can be incorporated into the following recommendations that I would like to offer PRIMO.

1. A governance section must be mandatory for every council and for every major undertaking. Just as a statement of compliance or an ‘in-control’ statement is currently required retrospectively, a governance statement must be required in advance. This section should outline how the governance of the issue is assessed and selected. I advise the Association of Netherlands Municipalities (VNG), the Intermunicipal Organisation (IPO) and the Union of Water Boards to take this forward, in the run-up to the new coalition agreement.

2. Establish a ‘The Future of the Netherlands’ Traineeship aimed at enriching systemic knowledge of urban and public administration, with a focus on networks, multi-level governance, chain management, the quadruple helix, circularity and resilience. This should incorporate a wide range of frameworks and tools. “Good tools are half the battle,” my father always used to say. And Mandela: “Education is the most powerful weapon you can use to change the world.” Let us do this.

3. Public Risk Management becomes a recognised profession. I advocate a certificate for directors, senior managers, group controllers, risk managers, and even external consultants. Anyone can and may now call themselves a risk manager or advisor. It seems as though we are still living a bit in the Middle Ages in that respect. There are certainly good training programs. But it is still a liberal profession. The professional within us must be addressed, recognised and formalised, certainly given the significant stakes. You know, ‘craftsmanship is mastery.’

4. I advocate a strong focus on a dialogue-oriented approach to assets and their risks. Spreadsheets are important, but not the solution to a better world. Content and management can be better aligned through dialogue. Just as you do, incidentally, when you go on holiday. Determining your destination and mapping out and arranging the route there. Common practice in the travel industry. In the public sector, however, these are separate processes. Dialogue replaces the current traditional approach to risk management based on probability x impact statistics. It is about the connections between the brain’s left and right hemispheres, between reason and gut feeling. I quote Nobel laureate Kahneman.

5. I advocate for an ISO Public Value. Focused on the full spectrum of public issues, stakeholders, forces and processes. With a clear glossary. Public risk is defined therein as ‘potential damage to a public value’, in line with the work of scientists such as Moore, Kahneman, Slovic, and Renn. At present, every organisation in the Netherlands has its own definition, often with a corresponding external consultant. The multitude of ISO systems calls for intervention. Each system has its own definition of risk. There is simply no agreement on this in Geneva. Moreover, most systems are of very limited application to public administration, as the interplay and synergy between government, the business sector, and civil society are virtually non-existent. A new, integrated system is therefore needed that aligns with governance based on public value itself.

I recommend that PRIMO, as the sole independent non-profit organisation, take the lead in this together with its partners. The field of public risk management deserves further development.

Leen Paape

Ultimately, it is mainly about narratives – stories, if you will – that we can share with one another. Language matters, certainly in a complex world. In his book ‘Against the Gods: The Remarkable Story of Risk’, Peter Bernstein describes the history of thinking and acting regarding risk. At the end, in the section ‘Awaiting the Wildness’, he concludes by noting that managing risks often creates new risks in turn. The complexity of everyday life is so immense that it is a never-ending story.

Interventions often lead to the same situation as with a waterbed; you press down here, and it rises there. Ergo, you are never finished, so you must make risk management a daily activity. This also brings the human factor into the picture. He or she is the most important and often also the weakest link; that is what needs to be worked on, and fortunately, this can be done through training.

Thanks to Nobel laureates Kahneman and Thaler, we now know much more about how people make decisions under uncertainty. The latter is also a good definition of risk management, as far as I’m concerned. Behavioral Economics teaches us that people are not entirely rational and that, when making decisions under uncertainty, we can be heavily influenced by so-called biases. Even algorithms are not infallible; on the contrary, they internalize the biases embedded in the data and lead to wrong decisions. Yes, so we are still only at the beginning. 

We now often blindly copy manuals and ISO standards, or each other. This is nicely termed ‘isomorphism’. If it’s good enough there, then surely it’s good enough here too. And, if it doesn’t work, it’s not our fault because everyone else did it that way. So context matters, and you will therefore have to think for yourselves whether and how it best fits your specific situation. That requires reflection and sitting down together at the table, the promise-maker and the deliverer together.

Closing remarks

Jack Kruf

A word of inspiration to conclude. The story of the Orient Express. As a metaphor for the new architecture of public risk management. With thanks to Tom Wustenberghs.

Here is my thought: to regard each of the major challenges for 2021 as an Orient Express. The first train ran in 1883 between London and Istanbul and was the brainchild of an engineer, George Nagelmackers. A groundbreaking concept that can now also be applied to major issues, such as long journeys.

He could have won the Nobel Prize for Governance for it. In a fragmented Europe of small states and kingdoms, every kilometer of that route was negotiated with governments, landowners, railway companies, banks, investors, and private firms. That single train ticket was administratively broken down into surcharges, offsets, and revenue models for every kilometer. It took a roomful of contracts, financing structures, and agreements to make this journey possible. Not to mention the locomotives, the stations that had to or could be called at, the variety of track gauges, landscapes, mountains, rivers, and valleys, and the expected weather conditions. An all-in-one package.

Now, in 2021, we are setting off once more. A journey, for example, from the present (fossil fuels) to 2050 (clean energy). A journey of a generation. From that of my daughters and sons-in-law towards a liveable world for my grandchildren, Sam, Sebas, and Nine. It is as concrete and simple as that. I have already bought my first Lego train, to practice… with them.

Who will be the new George Nagelmackers of the Energy Transition, who of the Circular Economy, and so on? We cannot all just build and negotiate. Coordination is needed. The concept of the Orient Express holds the keys to the new, much-desired system governance. It embodies the contours of the new public risk management. PRIMO and the new Orient Express: to me, it seems a fascinating combination.

Leen Paape

I am happy to endorse Jack’s call to make risk management value-driven. Jack’s call makes me want to mention the term ‘efficiency’ as well. In any case, as far as I am concerned, it is obvious that we should strive for simplicity. When complexity is high, zooming out is therefore important. We often tend to do the opposite, leading to more measures and instruments, which is the death knell. 

Complexity demands simplicity, and the roundabout is the metaphor for this. There is only one rule: the design is simple, cheap, and safe, and it leads to better traffic flow. With that in mind, I wish us all more roundabouts, but above all in a figurative sense. Clients and contractors must also meet more often, even if tendering rules prohibit it.

In line with that value-driven approach, I would like to prioritise the UN’s 17 Sustainable Development Goals. We were supposed to achieve them by 2030, but I think that was a little too optimistic. That does mean, however, that we need a designer – or, if you prefer, designers – of the network and the timetable to take us on that journey. A beautiful and liveable planet for our children and grandchildren – who wouldn’t want that? That vision surely appeals to us all, and it demands a major effort from society and businesses, with social well-being taking precedence. The goal is clear, and with that we can, whenever risks or uncertainties arise, try to manage them together and thus stay on course. We will need those 40 years, but the journey seems wonderful to me, and the many challenges we encounter create opportunities for our creativity and entrepreneurial spirit – not only to earn a decent living but also to learn from the life lessons along the way.

‘Life is lived forwards but understood backwards,’ as Kierkegaard said, and I wish us all wisdom and insight on that journey. Jack and I have already come a long way, but we would like to share some of our experience and try to spare us all the mistakes we ourselves have made along the way.

Jack Kruf & Leen Paape