A comprehensive risk maturity model for Dutch municipalities

Ignacio Jose Cienfuegos Spikin | 2013

Risk management is a trend in almost every sector. Public organisations such as local authorities are lagging behind in this area, but they now have a new support model at their disposal. Ignacio Cienfuegos Spikin, originally from Chile and a PhD graduate of the University of Twente in 2013, investigated the state of risk management within local authorities. He tested a ‘Risk maturity model’ he had developed across 72 local authorities. “The model provides valuable information to decision-makers”.

Ignacio Jose Cienfuegos Spikin: “Following the trend of organizations from almost every sector now, public entities such as municipalities have also started to develop risk management awareness in the last decades. Related to the pressure of a more demanding environment and the incidents that these organizations have experienced, this process has led to the development of special standards and the design of risk management policies by central governments.

Being an innovative case for the public context, Dutch municipalities have a distinctive bylaw on risk management. This regulation requires that municipalities consider in their budget, a financial resilience to confront possible unfunded risks. In order to comply with this bylaw, municipalities should at least have a method to identify unfunded risks as well as to mention the measures to be taken for those risk. Nonetheless, there might be some evidence indicating that municipalities in the Netherlands face some difficulties in the implementation of risk management practices (Boorsma and Haisma, 2005). Although there is not an accepted singular methodology for impartially measure management practices (Ibbs and Kwak, 2000), we consider that risk maturity models could contribute to the task of objectively assessing the implementation of risk management practices in Dutch municipalities.

However after an evaluation of current risk maturity models, we came to the conclusion that current models have some limitations. First of all, we estimate them as not being suitable for Dutch municipalities since most of them focus on a project risk management approach. Moreover, we state that in general risk maturity models do not respond to the comprehensive or integrated perspective of risk management. Additionally we argue that most of the existing risk maturity models do not consider the so called risk management cycle on their structure. Finally we believe that current risk maturity models lack on theoretical reflections about their maturity concepts and are not often validated (Wendler, 2012), basing their propositions mainly on the experiences of experts. Accordingly, we have done significant efforts in this PhD research to respond to the limitations of risk maturity models, since we strongly believe that it could be a pertinent instrument for the assessment of risk management process in Dutch municipalities, influencing also the implementation of best risk management practices by these organizations.

For the construction of a revised risk maturity model, we have used a design-oriented method, identifying first the main variables of the proposed model in a deductive manner. With the purposed of explaining the evolutionary logic assumed by risk maturity models and the measurement propositions of risk maturity models, we have used Organizational Change and Organizational Learning theory.

The application of the improved risk maturity model in a sample of 72 municipalities, delivered some interesting findings and empirical support for the construct validity of our model. From the five risk management stages included in the proposed model, separate scales were constructed which are based on a large number of different items. These items were measured using a survey 194 questionnaire. Overall scores were also calculated on this basis of 1 to 5 scale. The empirical research shows that there are large differences in risk maturity between municipalities, with a minimum of 1.7 and maximum of 4.5 (with an average score of 3.3). We confirmed that municipalities in our sample are still far away from the best practices of risk management, especially the wider or integrated perspective, due mainly to the limitations in their feedback mechanisms (Argyris and Schön, 1978).

Additionally we discovered in our sample a pattern indicating that larger municipalities have a higher risk maturity score, thus implemented more sophisticated risk management practices. In addition, we found that the entities that participated in the empirical part of our study, had higher scores in the first stages or dimensions of our model (risk objective, risk identification and risk analysis and measurement) while obtaining lower scores in the last dimensions (risk decision and control‖ and risk implementation and reviewing).

Additionally, we learned empirically that the dimensions or risk management processes in our model, had an evolutionary pattern that considers each of the different stages of this process as a prerequisite of the next phase. This finding is also interesting, since although the literature states that risk management should be applied following a sequence logically defined (i.e. risk objective, risk identification, risk assessment, risk control and risk implementation and reviewing) there would not be a clear proposition indicating that each stage of the risk management process would be a precondition to complete the next stage. We also analyzed possible associations between organizational arrangements (being member of the expert circle of the Ministry of Interior Affairs, the Public Risk Management Organization PRIMO and having a risk manager in the organization) and the risk maturity scores.

We came to the conclusion that these variables would also have an effect on the overall score of the municipalities in our sample. The latter finding is line with what we argued in the theoretical part of our research, where we assumed firsts that the participation of municipalities in both the expert circle and PRIMO could be seen as a source of risk management knowledge, since we followed what the literature on organizational learning suggested; that networks ties would provide access to information and outflows of knowledge (Schulz, 2001) for organizations through the interaction with peers, promoting an adaptive change (Kraatz, 1998).

Additionally we have also argued that the existence of an in-house specialist on risk management in the municipality might contribute to the development of uniform comprehensions of the risk management discipline (the organizational theory-in-use) (Huber, 1991). We have also analyzed in detail two outliers in our data set, reviewing carefully their risk management practices implemented, characterizing an ―immature and ―mature organization considering the implementation of risk management practices.

We believe that our study has a number of scientific as well as practical contributions. By establishing the goal of measuring the implementation of risk management practices, we have tried to adapt and improve risk maturity models. This has led us to investigate some theoretical propositions that could respond to the difficulties found in the literature. As mentioned by Wendler (2012), who developed a systematic literature review on maturity models, more 195 than half of the published articles in the field follow a conceptual research design (describing the maturity development) but fail in the theoretical reflection and empirical application of the proposed models. Our principal scientific contribution has been to study and interpret the logic of risk maturity models, identifying theories that could explain their reasoning. We have also incorporated in our model the different stages of the risk management cycle as the main forces for this evolutionary learning process.

Finally we have empirically validated our proposed risk maturity model in a sample of Dutch municipalities, assessing the risk management practices implemented in municipalities in the Netherlands. As a result, we believe that we have fulfilled the gaps found in the literature, making a relevant contribution to the field.

Even though we still considered this proposed risk maturity model a developing method that need additional enhancements, we also believe that our proposed model could be a pertinent method for the diagnosis of risk management practices of Dutch municipalities, as well as to influence the correct implementation of the discipline by these local entities. We consider that the risk maturity model and the data obtained due to its empirical application, could provide valuable information for decision-makers not only in Dutch municipalities, but also in provinces and water boards, which need to also implement risk management practices. These organizations might find the results of our thesis relevant as a benchmarking mechanism (comparing themselves to similar segments and categories) as well as for the evaluation of the risk management public policy that regulates them. Thus, our research could contribute in a further discussion on the approach of the resilience paragraph, since although this policy might be sufficient for the goal of preventing Dutch municipalities from having a major financial shortfall because of unforeseen events, it might not incentive the implementation of a wider perspective of risk management.”

Download dissertation Cienfuegos – Developing a Risk Maturity Model.

Bibliography

Argyris, C. and Schön, D. (1978) Organizational learning: A theory of action perspective. Reading, Mass: Addison Wesley.

Boorsma, P. and Haisma G. (2005) ‘Research on Public Risk Management with special references to Dutch Municipalities‘. Paper for the COE conference at Twente University. Unpublished.

Huber, G.P. (1991) Organizational Learning: The Contributing Processes and the Literatures. Organization Science, Vol.2, No.1, Special Issue: Organizational Learning: Papers in Honor (and by) James G. March, pp.88-115.

Ibbs, C.W. and Kwak, Y.H. (2000) Assessing Project Management Maturity. Project Management Journal, Vol. 31, No. 1, 32–43.

Kraatz, M. (1998) Learning by Association? Interorganizational Networks and Adaptation to Environmental Change. The Academy of Management Journal, Vol.41, pp.621-643.

Schulz, M. (2001) The uncertain relevance of newness: Organizational learning and knowledge flows. Academy of Management Journal, 44(4), 661– 682.

Wendler, R. (2012)  The maturity of maturity model research: A systematic mapping study. Information and Software Technology 54 (2012) 1317-1339.

Note

This article is the Dutch summary of the doctoral thesis (PDF). His supervisor is Prof. Dr Peter B. Boorsma, and his co-supervisor is Prof. Dr Harry van der Kaap, University of Twente. The research was carried out at the Institute for Innovation and Governance Studies, Faculty of Management and Governance, University of Twente, Enschede. Copyright © 2013 by Ignacio Cienfuegos. All rights reserved. ISBN:978-94-6203-497-6 University of Twente press release.