As a result of Romania's National Anti-Corruption Strategy (NAS), Decision 599/2018 outlines a methodology for assessing and managing corruption risks, along with a standard approach for evaluating integrity incidents. The framework aligns with established good practices recommended by the OECD and other international organisations.
Based on the interviews and focus groups, the OECD developed a behavioural flowchart to illustrate the explicit and implicit steps required to manage corruption risk. Despite following international standards and being apparently clear, the flowchart evidences that the methodology is de facto cognitively demanding and time-consuming. In addition, public managers typically lack the required expert knowledge; attempting to transform all public managers into anti-corruption experts would not be efficient.
This complexity of the methodology, along with its cognitive and time demands, leads to the following challenges that in the end undermine the effectiveness of corruption risk management in practice:
The first step to manage corruption risks is to identify the context where the risks may materialise. The Romanian methodology does not provide a clear definition of how to identify this context, however, leading authorities to identify corruption risk contexts using different criteria. This leads to not homogenous assessments which is making it difficult for authorities to compare their practices and for the Technical Secretariat of the NAS to provide meaningful feedback. Moreover, poorly identified risks create problems when designing meaningful intervention measures.
The complexity of assessing the likelihood and impact of risks may lead the internal working group members, who are in charge of leading the risk assessment at entity level, to use mental shortcuts (“heuristics”) and overlook important information needed to correctly assess the identified risks.
Intervention measures recur to “easy solutions”, such as recommending more trainings, and are designed without following a clear theory of change and an action plan. Indeed, many of the reviewed corruption risk registries suggest unspecified intervention measures. In addition, most interventions lack specified implementation timeframes and a clear verification method.