I joined U4 in August 2019, to lead the work on good governance as well as corruption risk management, but also to work on public outsourcing and anti-corruption’s certification process. I'm an anthropologist, specialised on norms transfer and norms implementation, with a special focus on good governance mechanisms (transparency, accountability and civil participation).

Prior to joining U4, I worked for various organisations and NGOs at the international level, including GIZ, NATO, the NATO Parliamentary Assembly, and International Crisis Group.

I did my PhD at the EHESS (Ecole des Hautes Etudes en Sciences Sociales) in France, on the transfer of good governance norms in Rwanda and Burundi. It highlights how good governance norms are defined and negotiated by development agencies, and how actors at the local level may manipulate, circumvent, or divert instruments and measures during the implementation process.

I also hold a Master degree in International Studies and Diplomacy from the SOAS University (London) and a Master in Competitive Intelligence from Lyon 3 University (France), as well as an LL.M. on International Relations and Political Science from the University of Bologna (Italy).

Whether diverting resources from aid delivery or eroding public trust in development organisations and projects, corruption poses a risk.

Corruption risk management is a process to identify, assess, and mitigate corruption risks within an organisation and its activities. It is also a way to analyse causes for corruption and ultimately to implement and manage corrective and preventive measures to curb corruption risks.


What we mean by corruption risk management

Corruption risk management (CRM) is a specific set of procedures and requirements to detect, assess, and mitigate corruption risks within an organisation. It is an important part of implementing anti-corruption policy. CRM holds a strategic dimension, as it implies backing from the top leadership and is integral to all decisions and activities of an organisation, from the institutional level to projects and programmes. What risks are we referring to?

Corruption risks relate to all kinds of risks inherent in and organisation’s activities, e.g:

Fiduciary risks (because of fraud or theft).

Safety risks (increasing the likelihood of accidents or illness).

Operational risks (viability to achieve objectives).

Information risks (hiding or withholding important data).

For example, favouritism within recruitment is a corruption risk for human resources management, and could be a reputational and operational risk for the organisation and its activities.

As with any other organisation, development aid agencies encounter corruption risks within 

 (eg bid rigging, manipulated tender specifications), human resources (eg conflict of interest, recruitment biases), as well as project financial and asset management. Risks also exist within implementing channels or external project partners, which can be public or private bodies, multi-donor trust funds, or NGOs. Accordingly, CRM helps to manage those risks, throughout the organisation.

At the institutional level, CRM is helpful in coordinating integrity and compliance policies, in defining rules and procedures, and in determining proper control mechanisms. CRM can help aid agencies to assess and mitigate corruption risks at all levels.

The rationale for CRM is not a cost/benefit analysis, but an investment to avoid the identified corruption risks from being able to harm the organisation and its development programmes. Mitigation benefits are measured in terms of the likely gains when leakages in projects are reduced, as well as indirect benefits in terms of strengthened control mechanisms and a lower level of corruption.

All organisations can apply CRM techniques – scaled to their own resources and capacities. Yet, development agencies or their partners may lack resources and anti-corruption experts; not all organisations can develop an empowered and well-defined anti-corruption department. How is it possible to streamline the use of CRM?

CRM at the policy and strategic level – examples

When development aid agencies develop CRM policies, they demonstrate a commitment to ethics, integrity, and responsible use of tax money. This is particularly true post Covid-19 with scarce resources and the need to optimise funding usage. At the same time, each CRM strategy is unique and tailored the organisation.

 considers CRM as a way to enhance public confidence in domestic and international institutions, and to increase prosperity at home and abroad.

Foreign, Commonwealth and Development Office (FCDO

 level. It operates with two different risk registers: 

FCDO deploys CRM by country – with explicit anti-corruption strategies for countries with high risk of corruption. One example is the 

2015 anti-corruption and counter fraud strategy for South Africa

. By collating information on corruption risks from different levels, managers become aware of potential problems and can use adequate mitigation mechanisms that are tailored to the local level.

, the French cooperation aid agency (AFD) also relates CRM to spending public money wisely. In addition, it uses CRM to optimise funding to partners in ways that best serve the purpose. The policy identifies three key moments to check corruption risks: during project instruction, contract signing, and project execution.

German Development Cooperation’s (GIZ) 

 emphasises how anti-corruption efforts relate to promoting integrity and good governance in partner countries.

 that manages corruption risks, avoids duplicating efforts, and facilitates knowledge sharing.

It can be challenging to define a CRM strategy. A first step is to understand how the organisation’s structure, size, and activities go along with its attitude towards CRM. Key factors to consider are stakeholders’ views and concerns, governance structure, legal environment, partners, and sector distinctions.

 may define a risk appetite, which determines the way the organisation assesses risks and carry out mitigation measures. (See the U4 blog 

Zero tolerance for corruption in international aid

 on the distinction between strict and a scaled approach.) A tough anti-corruption stance at the policy- or strategic level without clarity on how to apply it in practice can cause misinterpretations.

Another key step in defining a CRM strategy is to compile a register of corruption risks. It is thanks to this corruption risks register and the initial analysis on organisation’s specificities that will be determined the CRM governance structure and resource allocation. Not all development aid agencies have a defined anti-corruption strategy and may refer to several documents to manage corruption risks.  See also this separate 

list with examples of reference documents

 that development agencies use for CRM guidance.

Fraud and corruption control is often seen as a ‘corporate’ responsibility, as any wrongdoing can be harmful at the institutional level. A good example is the 

Danish development cooperation’s risk management guidelines

 levels. The guidelines emphasise the need to consider ‘operational security or reputational risk parameters’ for the institutional level.

Accordingly, it is important for central management to set rules and procedures to be followed throughout the organisation, and for how CRM will be structured. For CRM to work, there needs to be documented information in place – including internal and external communications on the anti-bribery policy and strategy. For example, in 2020, FCDO published 

 ­ – an operating framework for better programme delivery. It defines oversight functions and risk management governance.

Large development cooperation agencies can develop synergies between, for instance, compliance departments, audit offices, and CRM experts. This can help to streamline corruption risk management across existing monitoring and evaluation (M&E) processes. Strengthening interactions between control and programme functions can help integrate anti-corruption tools along delivery chains.

For example, the Danish foreign affairs ministry's 

 with anti-corruption experts and financial and development specialists. Those peer groups are helpful to prepare and follow project appraisal internally. Moreover, anti-corruption focal points are designated during implementation phase to work better with partners.

Development and humanitarian organisations should aim for a thorough project risk identification and mitigation process that is also clear on how to report and respond to corruption incidents. For example, CARE International has developed a 

 that outlines an internal escalation process to ensure appropriate management, awareness, and expeditious handling. Here, each contract holder has to ensure proper implementation of CRM measures, report regularly, and guide and train its staff, sub-grantees, and partners on the policy.

At the programme and project levels, anti-corruption efforts should not be an expensive burden that hampers activities, but rather a proportional measure to help stakeholders manage operations and risks, internally and externally.

Figure 1 below shows the different project phases – inception, development, implementation, termination – and their respective corruption risks. The yellow line shows that corruption risks already exist in the planning phase, rise during the implementation phase – when large sums of money can change hands – and diminish during the termination phase. 

Illustration of how corruption risk evolves in project phases

Corruption risks exist in all project phases. They peak during the implementation phase when large sums of money can change hands.

Corruption risks in the concept phase relate to decisions that can have a direct impact on stakeholders, target definitions, and intervention areas. Partners’ interests and their eagerness to see the project develop can influence scoping missions. When project appraisals are outsourced to consultants, it increases risks for fraudulent assessments, bribery undermining merit-based procedures, high-cost projects being promoted, etc. Political manoeuvres (for instance, to benefit certain constituencies), gifts and kickbacks, and conflicts of interest are other corruption risks that relate to this phase.

The concept phase is crucial for the initial identification and assessment of corruption risks, including political economy analysis to consider development aid programme impact.

For small organisations, it is mainly the middle management that is involved in risk definition. In larger organisations, anti-corruption experts are part of the process, at least as a back-up.

For risk assessment and risk mitigation, the Swedish International Development Cooperation Agency (Sida) provides 

 – an IT system that includes requirements for assessing risks, evaluating their potential impacts, and establishing mitigation approaches. Global Affairs Canada employs 

The development phase involves corruption risks when, for example, choices such as who will (or will not) be the beneficiaries and partners are specified in the terms of reference. Other risks include budget manipulation, vague criteria, and asymmetrical information. Moreover, the process around choosing partners is vulnerable to unethical practices: bribery, clientelism, conflicts of interest, etc.

It is crucial to establish control and M&E procedures, as these measures may have a huge impact on future corruption risks. Pay particular attention to 

. They influence the organisation’s capacity to control and mitigate corruption risks. It is hard to say if one funding modality is riskier than another – this depends on development aid agencies’ capacity to exert control and implement safeguards.

 is likely to assume overall responsibility of the project at the beginning of this phase. The project manager will rely on existing corruption risk assessments (such as country-level and sector-level assessments).

 conducts comprehensive, project-specific risk identification and assessment. This is a way to distribute responsibilities and take ownership of mitigation measures and strategies. The risk analysis findings should clarify precautionary measures and inform the project’s design and governance structure.

Best practice varies according to funding modalities. For budget support, specific 

 exist. Explicit control measures can be put in place when relying on external partners. For example, the Australian Department of Foreign Affairs and Trade have developed a 

fraud control toolkit for funding recipients

Activities such as recruitment and procurement take place at this stage – leading to a peak in disbursements. This is why there is a larger risk that involved actors engage in a variety of corrupt activities. These risks may be fiduciary (fraud, theft), reputational, operational, legal- and compliance-related, and more. For example, asset management, licences and access to services, per diems, procurements, and the selection of participants for training are common sources of corruption risks.

All organisations – big or small – should carefully allocate management and oversight responsibilities to ensure that tasks and outputs are properly monitored and supervised. The organisation should conduct a mid-term evaluation and 

 – of performance, finances, compliance, etc. – carrying out adequate controls.

There is no ‘one size fits all’ solution since each project has its unique characteristics – eg budget size and structure.

Larger organisations should have an anti-corruption team to support handling whistleblowing and fraud cases, and to help resolve ethical dilemmas: conflicts of interest, contract violations, etc.

Some also have specialised, central units that handle procurement.

Smaller organisations can engage skilled staff to perform first-party audits, or outsource the task to certified auditors.

 provides guidelines for internal audits. For whistleblowing, 

 provides a good solution that is free, open source, and secure. See also the 

 with a basic guide and examples of best practice.

The termination phase is not immune to corruption risks. With the perceived need (or urge) to disburse the remaining funds, malpractices may occur. End-of-contract activities can increase exposure to pressures and opportunistic behaviour. With the closing of accounts, breaches may be exposed, such as fraudulent document results, collusion between programme managers and evaluators or auditors, undermined evaluations, etc.

Organisations should include CRM in programme- and project control operations and evaluations. M&E insights should be used to improve the CRM framework’s quality.

For larger organisations, anti-corruption experts may help in project evaluation. For all organisations, dedicated services should control financial aspects. Evaluators should also check how relevant and effective the CRM framework has been.

Financialaudits focus on compliance with applicable statutes and regulations. The 

 from the European Court of Auditors is a comprehensive guide for such audits.

Illustration of the corruption risk management cycle. From identifying risks to assessing risk levels and mitigating risks.

 (the person in charge of implementing recommendations) and 

Risk identification involves an inventory of all corruption risks that could threaten project delivery. It can be part of a more general risk management system. The organisation establishes a risk register and identifies the source of any risks, their causes and effects, and type – 

In the inventory, one has to distinguish between minor and major risks – depending on how they can potentially affect programme outcomes. This helps establish the risk thresholds and future mitigation targets.

Defining risk thresholds can be difficult (especially with a ‘zero tolerance for corruption’ policy). This involves distinguishing acceptable risks – low impact and probability – from those that should generate a necessary mitigation reaction. Organisations should carry out an initial risk identification at the appraisal or development stage, and later review the register regularly as situations may evolve.

Programme managers should identify relevant risks. For example, international red flags developed by the 

 show where to look for corruption risks in procurement. Previous country and sector assessments from project appraisals should inform their analysis. When there is an anti-corruption team within the organisation, it should provide support to define specific risks. 

U4 Guide to using corruption measurements and analysis tools for development programming

. Approaches can rely on quantitative or qualitative data, or a mix of both. Document reviews, brainstorming, participatory methodologies (such as interviews with employees or stakeholders), and horizon scanning are all valid tools to identify risks.

 for public financial management (p.8) helps to understand partners’ capacities and environment. The Australian Department of Foreign Affairs and Trade (DFAT)’s 

 (p.7) defines events that may occur, their causes, and their potential impact.

Corruption risk management

Procedures for development aid agencies to identify, assess, and mitigate corruption risks

From basic guides to in-depth perspectives, all in one place.

Inform your anti-corruption work with handpicked topic related publications, insights and ideas.

Getting the most out of the ISO 37001 standard

Why is corruption risk management so hard? Assessing current practices in development aid

Integrity and integrity management in public life

Overview of corruption risk management approaches and key vulnerabilities in development assistance

Guide to using corruption measurements and analysis tools for development programming

Cost-effectiveness and cost-benefit analysis of governance and anti-corruption activities

The basics of corruption risk management: A framework for decision making and integration into the project cycles

Explore all our resources

Hi!
I’m developing this topic.

Guillaume Nicaise

The whole U4 team

Corruption risk management

Procedures for development aid agencies to identify, assess, and mitigate corruption risks

From basic guides to in-depth perspectives, all in one place.

Basic guide

Inform your anti-corruption work with handpicked topic related publications, insights and ideas.

Getting the most out of the ISO 37001 standard

Why is corruption risk management so hard? Assessing current practices in development aid

Integrity and integrity management in public life

Overview of corruption risk management approaches and key vulnerabilities in development assistance

Guide to using corruption measurements and analysis tools for development programming

Cost-effectiveness and cost-benefit analysis of governance and anti-corruption activities

The basics of corruption risk management: A framework for decision making and integration into the project cycles

Explore all our resources

Hi!I’m developing this topic.

Guillaume Nicaise

The whole U4 team

Are you U4 partner staff?Take advantage of exclusive U4 services.

Online training

Workshops and events

Helpdesk for partners

See all our partners

Subscribe to our newsletter:

Hi!
I’m developing this topic.

Are you U4 partner staff?
Take advantage of exclusive U4 services.