Ten steps to holistic risk management for municipalities

Falling tax revenues, insufficient liquidity, inadequate waste disposal, misappropriation of state funds, an IT failure, high staff turnover, cost increases in social welfare, etc. In the face of such risks, the municipalities have always carried out internal controls and have certainly taken risk considerations into account in strategic issues. However, the municipalities still approach this too little systematically, as became clear in the context of a corresponding research project of the two universities.

Nineteen municipalities and districts in German-speaking Switzerland participated in this project. As the research showed, only three of them had implemented a formal internal control system (ICS) and only two municipalities additionally operated a risk management system. However, the use of both instruments is becoming more urgent as municipal tasks become increasingly complex. At the same time, the public increasingly expects efficient, cost-effective administrative activities and responsible handling of taxpayers' money.

An internal control system operates mainly at the operational level. It helps to ensure truthful reporting, protect the municipality's assets, optimize work processes and ensure legally compliant actions. Risk management, on the other hand, is a systematic process that is primarily applied to decisions at the strategic level. Potential events affecting the municipality should be identified at an early stage in order to exploit their positive effects and mitigate the negative ones. In this way, the community's goals can be achieved more reliably.

Community-specific risk catalogue

The 19 municipalities and districts from German-speaking Switzerland listed

•  in addition to the above-mentioned
• other risks. These were divided into five categories within the scope of the study:

1) financial risks

2) legal risks

3) operational risks

4) strategic risks and

5) Property and natural hazards

The full survey shows that the municipalities most frequently cited financial risks as well as property and natural hazards. When asked about the risks in five to ten years, further categories were added: According to the municipalities and districts, social, strategic and political issues in particular are likely to become a challenge. The appointment of authorities or the declining willingness of the population to participate in the community are examples of this.

Holistic view

Risks should be managed not only at the operational level, but also at the strategic level. Such a holistic risk management does not have to be complicated, but can be developed quite pragmatically. For this purpose, the two universities of applied sciences have developed a guideline according to which the municipalities can introduce a risk management and an internal control system. Basically, the introduction takes place in three phases: planning, implementation and operation. In the guide, these are divided into ten steps that lead successively to the goal.

The 10-step plan (as a central element of the guide):

1. Vorpreparation: Municipal council resolution for holistic risk management; prepare concept manual.

2. Internal environment: Create/deepen risk and control culture; stocktaking: what elements already exist, what is still missing?

3. information and communication: Define internal and external communication.

4. risk management: Identify, record and evaluate risks; determine measures.

5. internal control system: Determine organizational areas, analyze financial statements, select key processes and assign controls.

6. linkage: Risk management and internal control system: Identifying and exploiting synergies between the two instruments.

7. action plan: List and address weaknesses identified; action plan is maintained in parallel with overall implementation and deliberately tracked near completion.

8. presentation to the local council: Provide opportunity for council to make corrections/additions.

9. completion of implementation: Have holistic risk management approved by municipal council resolution.

10. information and training: Employees learn about their role in helping communities identify and assess potential risks.

It is advisable to appoint an interdisciplinary team of specialists who will also draw up a risk catalogue tailored to the community.

Scope of the internal control system

Particular attention is paid to the scope of the internal control system for municipalities. In the private sector, such a system is almost

Finally, asset protection is an important issue.

The focus is exclusively on correct bookkeeping and reliable financial reporting. For municipalities, this falls short, because public administrations are required by law, among other things, to manage their budgets efficiently and effectively. The population has a right to legal certainty and equality of rights, and finally, asset protection is an important issue.

Researchers are not the only ones who are convinced that holistic risk management is becoming increasingly important for public administrations. The municipalities themselves also assess the future significance of risk management and ICS as high or increasing. This is one of the reasons why the Federal Commission for Technology and Innovation (CTI) financially supported the research project and thus the development of the guide. The fiduciary and auditing company Mattig Suter und Partner was involved as the main implementation partner.

The book "Holistic Risk Management in 10 Steps - Risk Management and ICS for Swiss Municipalities" summarizes the results of the research project and describes in detail the ten steps leading to holistic risk management. The appendix contains a number of aids such as a risk catalogue, checklists, etc. The book can be ordered from Haupt Verlag Bern.