In recent years the topic of risk management has moved up the agenda of both government
and industry, and private sector initiatives to improve risk and internal control systems
have been mirrored by similar promptings for change in the public sector. Both regulators
and practitioners now view risk management as an integral part of the process of corporate
governance, and an aid to the achievement of strategic objectives.
The paper uses case study material on the risk management control system at Birmingham
City Council to extend existing theory by developing a contingency theory for the
public sector. The case demonstrates that whilst the structure of the control system fits a
generic model, the operational details indicate that controls are contingent upon three core
variables—central government policies, information and communication technology and
organisational size. All three contingent variables are suitable for testing the theory across
the broader public sector arena.