___________________________________________________________________________
Corruption Risk Assessment
Topic Guide
___________________________________________________________________________
Contents
• What is corruption risk assessment?
• Purpose and context of the assessments
• Assessment approaches
• Data sources
• Key issues and challenges
• Examples of promising practices
What is corruption risk assessment?
Corruption risk assessment is a (diagnostic) tool which seeks to identify weaknesses within a
system which may present opportunities for corruption to occur. It differs from many other
corruption assessment tools in that it focuses on the potential for - rather than the
perception, existence or extent of - corruption. At it’s core a risk assessment tends to involve
some degree of evaluation of the likelihood of corruption occurring and/or the impact it
would have should it occur.
Purpose and context of the assessment
The purpose of a corruption risk assessment is usually to supplement evidence of actual or
perceived corruption in a given context in order to inform anti-corruption strategies and
policies or for advocacy purposes. It can also serve as a baseline for anti-corruption work to
track changes in risks over time. Corruption risk assessment can be applied at all levels from
government institutions, to donor support programmes, down to sectoral programmes, as
well as in individual organisations or units. It is often undertaken as part of a larger
corruption assessment exercise.
Assessment approaches
As a general rule most corruption risk assessments take an institutional approach, ie they
aim to identify weaknesses in (the enforcement of) rules and regulations in the institution,
sector and/or process under analysis. Beyond this, however the conceptualisation of risk
varies from tool to tool, for example:
1. Corruption risk is equated with the set of institutional vulnerabilities within a system
or process which might favour or facilitate corrupt practices1
2. Measures of institutional vulnerability are combined with data on perceptions
and/or experience of corruption as a proxy for corruption risk2
1
e.g. TI - Procurement Risk Map, Centre for Combating Economic Crimes and Corruption – Moldova’s
Corruption Risk Assessment in Public Institutions
2
e.g. TI - Transparency and Integrity in Service Delivery in Africa (TISDA) Risk Map
1
3. Risk is expressed as a factor of the likelihood of corruption multiplied by the impact
of corruption3
4. Objective risks (weak institutions and regulations) are differentiated from subjective
risks (tolerance to corruption, personal motivation, weighing up of costs/benefits,
past experiences)4
5. Corruption risk is understood as a factor of the level of transparency and level of
fairness in a process5
6. Corruption risk is understood as the difference between actual and ideal systems6
Thus the sophistication of risk assessments ranges from identification of corruption (or
integrity) and/or institutional weaknesses/gaps as an indicator of risk of further corruption,
to an analysis of the impact and estimation of the likelihood of corrupt practices. Moving
from the identification of risks to ‘actionable’ information, further stages in the assessment
may include prioritization of risks, identification of tools to address the identified risks, and
guidance on the development anti-corruption strategies (although strictly speaking the latter
stages are beyond the scope of a ‘core’ risk assessment) (see figure 1 below). In many cases,
the first stage serves to identify broad risk areas (usually through secondary sources) which
are then analysed in more detail in the second stage. In some cases, intermediate steps in
the analysis are left out, such as the assessment of impact and likelihood of corrupt
practices. In other cases the analysis stops at the risk identification stage, or even at the
point of identifying ‘institutional weaknesses’.
Figure 1: Possible elements of a corruption risk assessment
3
e.g. WB - Governance Analysis Toolkit for Customs and Border Management, TI - An Analysis of
Corruption in the Forestry Sector, ADB - Addressing Sector Governance and Corruption Risks in
Infrastructure Projects
4
e.g. Proetica - Corruption Risk Maps in Peru
5
e.g. Business Anti-Corruption Portal - Public Procurement Due Diligence Tools
6
e.g. TI - Procurement Risk Map
2
It is worth noting that the different elements of a risk assessment identified above may be
more or less appropriate for different levels of analysis. Broadly speaking, an analysis of the
overall governance context and assessment of institutional vulnerabilities are most useful
for sector-wide or national level risk analysis, whereas deeper analysis of actors and
relationships are particularly important for programme/project level analysis.
The results of a risk assessment can be presented in a number of ways. In some cases, risks
are visualised through a corruption risk map which highlights key stages, actors and/or
relationships in the process under analysis. Another visual tool is the corruption risk matrix
which is often used to prioritize risks (see figure 2 below). More often than not however,
results are either presented in tabular form or as a checklist. Where the risk assessment is
part of a broader risk management framework, these inform what preventative action needs
to be taken to mitigate the most critical risks.
Figure 2: Basic risk matrix
Likelihood of corruption
Medium risk High risk High risk
Low risk Medium risk High risk
Low risk Low risk Medium risk
Impact of corruption
One of the key benefits of corruption risk assessment is that it can compliment evidence of
corrupt practices to give a better understanding of the corruption situation in a given
context. Moreover, corruption risk assessments can serve to visualise the relationships
between different risks and actors and identify specific areas where limited resources can be
most effectively channelled.
Unfortunately, guidance on how to assess the specific level of risk is often weak or non-
existent. There is often an implicit assumption that low capacity and weak institutions/
regulations are more likely to foster corruption, but the level of risk that these weaknesses
yield is not always explicitly assessed. In many cases what is termed a risk assessment is in
fact an attempt at detecting the incidence and extent of corruption. The focus is on the
extent to which identified corrupt practices might affect performance (ie risk of negative
impact of corruption) rather than the existence of conditions which may facilitate corrupt
practices.
3
Furthermore, attributing risk, however defined, generally relies on the judgement of
(internal or external) experts. Yet the basis on which judgements are made is not always
explicit. One exception is TI’s Corruption in Forestry tool which includes a set of criteria for
estimating the impact of a practice in terms of social, financial and governance indicators
and which bases the likelihood of a practice occurring on an assessment of existing
legislation and the extent to which it is being implemented.
Data sources
Most corruption risk assessments use a combination of secondary sources (legal-institutional
analysis and desk research) and primary sources (household surveys and questionnaires,
focus groups, key informant interviews, checklists). Secondary sources are often used in the
preliminary stages to give a picture of the overall governance environment in a country,
institution and sector, or to identify priority risk areas. Primary sources are used for deeper
analysis of the more critical corruption risks (or perceived risks). In addition some form of
expert analysis is usually required to assess the level of risk (e.g. likelihood and probability of
corruption).
Key issues and challenges
Corruption risk assessments do not need to be too resource intensive. In contrast with tools
which aim at establishing the incidence, scope and forms of corruption, much of the data
required for risk assessments can be collected from existing sources although some
additional primary sources may be needed for the specific system/process under analysis.
Nevertheless, it may be that some data is difficult for ‘outsiders’ to access, for example it
may be particularly difficult for a civil society organisation to get reliable information on the
extent to which regulations are enforced within a government institution.
Using the informed opinions of those closely involved in the process under analysis can serve
as a useful proxy for such data. It is important to recognise that the selection of stakeholders
who are consulted as part of the assessment will have an important bearing on which risks
are identified and prioritised. For example, an informant working for a government agency
may well have a very different perspective on which risks are most prevalent as compared to
a civil society or community representative.
In light of these considerations, an important conclusion is that the outcomes of – as well as
the resources required for – a risk assessment will depend largely on: a) who is undertaking
the assessment and who is consulted, and b) which of the possible elements outlined in
figure 1 are included.
Examples of promising practices
• Actionability: The World Bank’s Governance Analysis Toolkit for Customs and Border
Management combines the level of corruption risk (Corruption Opportunity Index)
with an assessment of the level at which risk can be managed (Corruption
Vulnerability Index) and the number of actors responsible (Governance
Responsibility Index) in order to target the most important and easiest to implement
governance reforms. Thus the most ‘actionable’ risks are those with a high
opportunity score and low vulnerability and responsibility scores.
• Cascading approach: A number of risk assessments, especially those which relate to
donor support, are undertaken in the context of a broader governance risk
management framework, usually to inform country assistance strategies. A common
4
approach is to look at how risks ‘cascade’ from country-level, down to sector level
and then programme/project level with the analysis at each level
informing/providing context for the one below. A further step is then to assess the
extent and likely success of government action to address priority risks7.
• Relationships and value chain analysis: A number of tools focus on corruption risks in
terms of actors, relationships and interactions, or conduct a value chain analysis to
pinpoint areas where corruption is most likely to occur8. The benefit of this approach
is that it highlights specific ‘hotspots’ where action to reduce risks can be
concentrated.
All tools referenced in this guide are accessible via the gateway tool database:
[Link]
7
e.g. ADB - Guidelines for Implementing ADB’s Second Governance and Anticorruption Action Plan
(GACAP II): Cascading Risk Assessment Approach, WB - Deterring Corruption and Improving
Governance in the Electricity Sector
8
e.g. TI - Transparency and Integrity in Service Delivery in Africa (TISDA) Risk Map, ADB - Guidelines
for Implementing ADB’s Second Governance and Anticorruption Action Plan (GACAP II): Cascading
Risk Assessment Approach
5
Author:
Andy McDevitt, Transparency International
Reviewed by:
Kristof Gosztony, European Stability Initiative
Finn Heinrich, Transparency International
Date:
July 2011
[Link]
The GATEway project is co-funded by the
European Commission and the United
Nations Development Programme.