59821 investment climate April 2010 IN PRACTICE trade logistics no. 12 Managing Risk in Customs Lessons from the New Zealand Customs Service The New Zealand Customs Service's risk management system enables rebecca Foley Bruce Northway it to manage large volumes of cargo crossing borders with limited resources. The system encompasses a culture of problem-solving and Rebecca Foley is a Senior Policy Analyst in the International accountability for decisions, a standard methodology for identifying Relations unit of the New and assessing risk, and an intelligence function that applies this Zealand Customs Service's Policy Group. methodology. This note highlights the fundamental principles and Bruce Northway is a Chief processes guiding the system, offering lessons for governments Customs Officer in the reforming their trade logistics functions to meet global standards and Intelligence group of the New Zealand Customs Service. security requirements. He also conducts risk management training for the New Zealand Customs Service and external parties. In conducting their responsibilities for managing by a standardized methodology and strong borders and collecting revenue, customs intelligence efforts. This note is one in a series administrations operate in environments of developed by the Trade uncertainty and change. It is not easy to predict, Logistics team of the World for example, how many people, craft,1 and goods Defining risk management Bank Group's Investment crossing a border will break the law or how they in customs Climate Advisory Services. will do so--say, by entering a country illegally, The series focuses on smuggling drugs, or not paying tariffs. And it is A risk is the chance of something happening that not feasible to manually check every person, craft, implementation aspects of will undermine objectives. Risk is measured in and good that enters or leaves a country. terms of likelihood (rare, unlikely, possible, likely, recent trade reform initiatives or almost certain) and consequences (insignificant, and risk management issues. Instead, countries must develop methods that minor, moderate, major, or extreme). The Trade Logistics team identify cross-border activities or transactions with advises governments in the potential to pose risk. With their experience Likelihood is calculated quantitatively or developing and transition managing borders, customs administrations are qualitatively, while consequences can be measured economies on improving uniquely positioned to conduct risk management-- using a number of criteria. When assessing risks their import, export, and risk enabling them to make effective interventions affecting customs, it is recommended that the management systems and in the supply chain without constraining following consequences be considered: economic procedures to increase their legitimate trade. This note describes how risk costs, lives lost, lives damaged or severely affected, potential for trade and management has become part of the culture of intangible social or environmental costs, and investment. the New Zealand Customs Service, supported damage to a country's reputation. Risk management is a logical, systematic method The evolution of New that identifies, analyzes, evaluates, treats, monitors, Zealand's customs system and communicates risks in a way that minimizes losses and maximizes opportunities. For the New Between its inception in 1840 and the 1970s, the Zealand Customs Service, risk management refers New Zealand customs administration relied on to the culture, processes, systems, and structures a paper-based border management system that developed to manage potential risks and their required 100 percent compliance: everything that adverse effects. entered the country was examined. Goods were processed in days, not hours, and developing To manage risk, a customs administration must competent customs officers took years of training. change how it thinks and acts. It must move away from traditional methods and adopt new As New Zealand's economy began diversifying in ways of solving problems, including developing the 1970s, the customs administration had to deal accountability for decisionmaking (Box 1). Effective with a growing number of trade partners and a risk management increases accountability in decision- wider range of imports. The decade also saw the making and provides an audit trail, helping to ensure growth of containerized shipping and the beginning that decisions mesh with relevant legal requirements of cargo transported by air. and government policies. It also ensures that the behavior of customs officers is consistent with To avoid harming the increased and diversified trade standards for public service. flows, the customs administration had to process imports more quickly. At the time the administration New Zealand operated an inspection-based customs needed 10 days to process imports, requiring function for more than 150 years before initiating reference checks against at least 60 documents. a modernization program in the 1990s. The program The changes in trade patterns, combined with the had important implications for risk management. new ability to automate, led to changes in customs Risk management became an integral part of clearance--moving the system for processing customs practice and was slowly integrated with imports away from physical inspection toward risk the administration's culture--meaning that all staff management. bear responsibility for it. In 1981 the customs administration introduced its first computer system, CASPER (Customs and Statistics Processing of Entries and Retrieval), which automated trade processing and provided a Box 1: A Holistic Approach technical platform for randomly sampling imports to Risk Management for compliance and for running national alerts on high-risk goods. CASPER was operational for 16 years, but by the early 1990s the system was A robust approach to risk management requires four types of thinking to nearing the end of its useful life. It was costly to shape needed processes and tools: maintain and operate and very difficult to modify. It also limited the customs administration's ability to Rigorous thinking--ensuring that everyday decisionmaking is guided adapt to changing market and economic conditions. by logical, systematic processes. Forward thinking--managing proactively rather than reactively. Risk CASPER's limited functionality--combined with pressures facing the New Zealand Customs Service-- management is about identifying and being prepared for what can drove the need for change. Pressures included happen. minimizing operating costs due to a decline in Responsible thinking--taking action to manage risk, avoid or government funding, maintaining the quality of reduce adverse exposure, and maximize the potential of identified border protection, minimizing the risk to revenue opportunities. collection, increasing assistance to the business community, and supporting New Zealand's economic Balanced thinking--striking a balance between the costs and benefits growth. of managing risk. A risk-free environment is impossible (if not uneconomic) to achieve, so the administration needs to decide what The need for change led to the Customs level of risk is acceptable. Modernization (CusMod) program of the 1990s. iN Practice TRAdE LogISTICS 2 CusMod reflected a transformation in how the The risk management methodology is flexible, New Zealand Customs Service conducted its adaptable, and takes into account changes in the business and in the work performed by customs operating environment, including in processes officials. A two-year project, CusMod involved and legislation. It can be applied to any situation more than just developing new information where an undesired or unexpected outcome could systems. It took a holistic approach to protecting have a significant impact or where opportunities borders. The customs administration reviewed its are identified. Applying the methodology informs entire operations, including its strategies, the types of decisionmakers of possible outcomes and enables staff required, processes for improvements, and the them to control their impacts. required technology. Establish the context CusMod enabled New Zealand Customs to integrate This stage defines the strategic, organizational, and goods, craft, passengers, and intelligence systems risk management context, because any effort to and develop better ways of identifying and mitigating manage customs or other risk must first establish risks. Major operational improvements resulted, what needs to be managed. For example, is it general such as much faster goods handling and increased arrival processes, specific border transactions, or flexibility and responsiveness. Work processes were improved and information systems implemented that empowered staff to manage their work more Figure 1: New Zealand's Risk Management effectively. In addition, risk management priorities Methodology were set at the national level, based on government priorities, leading to better targeting of the areas of greatest risk. The changes reduced the impact of customs activities Establish the context on legitimate trade and travel, resulting in more effective use of resources. Other benefits included increased enforcement effectiveness and revenue collection. Communicate and consult Identify risks Monitor and review A standard methodology for managing risk New Zealand's government has adopted a standard Analyze risks methodology for identifying and assessing risk in all government entities. (The methodology is a joint standard with Australia, prepared by Standards Australia and Standards New Zealand and subjected to frequent reviews by both.) Having one standard Evaluate risks ensures consistency in the government's approach to risk management. The standard contains an extensive list of precise definitions for terminology to provide a common language for practitioners. Many businesses use the same standard. Treat risks The standard provides a generic guide for establishing and implementing risk management. It is a cyclic, recurring methodology of seven well-defined steps that support better decisionmaking by providing e seven-stage risk management methodology analyzes and evaluates risks insight into risks and their impacts (Figure 1). The (indicated by the yellow panel). An eighth stage--documentation and information standard also requires that organizations review storage--applies to analysis and data collected in all stages. their risks regularly. iN Practice TRAdE LogISTICS 3 internal processes? Determining what needs to be Likelihood and consequences must be assessed managed helps set the parameters of the context. The independently. following questions can be used to establish context. Key questions Internal environment What is the potential likelihood of a risk What are the customs administration's goals occurring? and structure? What are the potential consequences of a risk The risk management If risk management is targeting a specific if it occurs? process or activity, what capabilities and methodology must Once likelihood and consequences have been resources are available to manage that process address a range of issues or activity? assessed, the overall level of risk can be determined. What criteria are used to assess risks and at each stage. determine if intervention is needed? Evaluate risks What are the scope and limits of risk This stage compares estimated risk levels with management? Is it national, government- established criteria, enabling risks to be ranked to wide, or limited to the customs identify management priorities. Risks are then administration? assessed to determine whether they are acceptable. External environment Treat risks What goods or people are involved? This stage accepts and monitors low-priority risks. For If imported goods are being rated for risk, other risks, specific management recommendations could a domestic industry be affected by the or plans are developed and implemented. Treatment ratings? Are the goods subject to specific laws, can include avoiding or reducing the likelihood controls, or duties? and consequences of risks or transferring them to What are the expectations of stakeholders such another party. as the government, affected communities, Monitor and review traders, and other private sector groups? This stage monitors and reviews the performance What is the social, political, and cultural of the risk management system, including changes situation? that might affect it and whether the original risks What is known about the country of origin remain static. and that country's trade environment? What other details are known about the Key questions process or activity? Are assumptions about risks still valid? Are treatments for minimizing risks effective? Identify risks Are the treatments cost-effective? This stage uses a systematic process to identify what, Are management and accounting controls why, and how risks could arise, to form the basis for adequate? further analysis. Do the treatments comply with legal requirements and government and Key questions organizational policies? What are the sources of risks? How can the system be improved? What, why, and how would risks occur? What controls may detect or prevent risks? Communicate and consult What accountability mechanisms and During this stage the customs administration controls--internal and external--are in communicates and consults with internal and place? external stakeholders as appropriate at each stage of What and how much research is needed the risk management process and for the process as about specific risks? How reliable is the a whole. This stage should be planned and ongoing, information? addressing not just the process but any issues that arise. Analyze risks This stage identifies the potential likelihood of risks To these seven stages the New Zealand Customs occurring and the consequences should they occur. Service adds documentation and information iN Practice TRAdE LogISTICS 4 storage. At all stages of the risk management process, In addition, the NTC adds value because it is staffed the following must be documented and stored in a by customs officers as well as officers from other way that enables their retrieval: assumptions, methods border agencies, such as Immigration New Zealand used, data sources, logic and analysis, results, and and the Ministry of Agriculture and Forestry. decisions made and the reasoning behind them. At some point the process may be reviewed or The NTC is responsible for: audited--and to ensure accountability, documentation should indicate why decisions were made and actions Identifying risky border transactions. Risk management were taken. Directing activities related to passenger, trade, advances trade security and shipping risks, and providing response A key point of this risk management methodology briefings 24 hours a day, 7 days a week. and facilitation by is that it is a recurring process that can contribute Improving operational capacity to respond to organizational improvement. With each cycle, rapidly and efficiently to a range of border enabling customs to risk criteria can be strengthened to progressively threats. focus on high-risk trade. achieve better risk management. Managing the advance information received, such as advance passenger information, import and export entries, freight manifests, Putting risk management and craft movements. into practice Working with other agencies domestically and internationally. The methodology described above is applied by the New Zealand Customs Service's intelligence group, New Zealand is developing the NTC's functions so which has about 60 staff members and is responsible that it supports all government activities to target for assessing, prioritizing, and recommending border risks and links more closely with other treatment for identified risks. The group's activities international intelligence centers so that they can enable the proper functioning of the entire customs work together to identify international border administration. risks. The intelligence group's role rests on a fundamental risk management principle: those who assess risk Lessons should not manage it. Independent risk assessment removes the potential for adjusting the level of risk to The New Zealand Customs Service's experience suit available resources, such as the number of staff with implementing risk management offers key available at a given time. Distinguishing these roles lessons for reformers elsewhere: also allows operational decisions about priorities and resource allocations to be made on an informed basis Risk management is an effective, efficient independently of risk identification and assessment. way for customs administrations to deal with large trade volumes when resources are The intelligence group is responsible for producing limited and risks are constantly changing. impartial risk assessments about border transactions Implementing risk management requires (people, craft, and goods) and associated entities trust in a customs administration's processes. that inform potential intervention strategies. These It also requires recognizing that it is risk assessments are linked to operations through impossible to be risk-free. New Zealand's National Targeting Centre (NTC). The NTC applies the intelligence assessments at a Risk management advances trade security tactical level to identify specific border transactions. and facilitation because it enables a customs Until the NTC was established in 2006, intelligence administration to focus on high-risk trade. and operations were separate--resulting in a disconnect between the customs administration's strategy and Risk management is not just about having operations. good processes. It is a way of thinking that moves a customs administration toward The NTC has improved customs risk management proactive--rather than reactive--border because intelligence drives interventions at the border. management. iN Practice TRAdE LogISTICS 5 Risk management in customs, including and increases the amount of available intelligence and operations, must rest on information, improving understanding of modern legislation. Legislation should enable the border environment. New Zealand's information collection and sharing, including Joint Border Management System (JBMS) internationally where appropriate. It also represents a partnership approach to should provide a legal basis for operations. managing border risk (Box 2). If needed, legislation should be updated to reflect changing risk management processes. Management of customs risk cannot rely solely on domestic cooperation: it also Risk management should be viewed as a benefits from an international component. continually evolving process. Though the Working across borders with other intelligence basic thinking underpinning risk management and enforcement agencies enhances risk may remain the same, its cyclical nature management by improving information allows constant improvement. This may mean collection and enforcement options. tweaking estimated risk levels, introducing new technologies, or sharing more risk with A comprehensive approach to managing other supply chain participants. customs risks must marry risk management with intelligence and operations. Effective Risk management is enhanced when customs processes require well-trained staff, suitable administrations work with other domestic systems, knowledge transfer between agencies involved in border protection. domestic agencies, and international Working together can reduce the cost of collaboration. Risk management processes implementing risk management processes must also be subject to checks and balances. Box 2: The Joint Border Management System--A New Development in Risk Management Customs administrations operate in environments of uncertainty driven by domestic and external changes. Domestic drivers include the expectations of government, traders, and travelers for efficient, effective, seamless service delivery at the border. External drivers include the changing trade environment, including enhanced security requirements for cargo entering the United States and the need to meet global standards such as those developed by the World Customs Organization. The New Zealand Customs Service has managed change by continually improving risk management processes. One important fu- ture development is implementation of a Joint Border Management System to replace the aged and limited systems run separately by Customs and the Ministry of Agriculture and Forestry. The JBMS will ultimately manage all flows of people, craft, and goods entering or leaving New Zealand. It will deliver a wide variety of services across border agencies, including customs, biosecurity, and immigration. The JBMS will provide a fully integrated risk management framework that harnesses sophisticated data matching and profiling technologies to provide Customs and the Ministry of Agriculture and Forestry with more accurate risk assessments and smarter targeting--and, as a result, higher-quality outcomes from interventions. The system's technology will identify compliant passengers, craft, and goods, allowing them to move quickly across borders. It will make border crossings more efficient while protecting New Zealand's welfare and reputation. In short, the JBMS will enhance border risk management by incorporating a comprehensive risk management model that protects New Zealand from the risks arising from international travel and trade. iN Practice TRAdE LogISTICS 6 Risk management does not require The customs administration arrives at the targeting IN PRACTICE expensive computer systems. As long as figures for passengers and goods by constantly the flow of high-quality information is testing and refining the risk management process-- The Investment Climate IN assured, high-quality decisions can be made including intelligence--and by assessing available PRACTICE note series is published about risk assessment. Computer systems resources. The cyclical nature of the risk management may expedite this process, but they are not framework allows the administration to test the by the Investment Climate mandatory. accuracy of its targeting figures, including through Advisory Services of the World random inspections, to ensure that it is protecting Bank Group. It discusses practical If a customs administration is looking to New Zealand's borders and revenue. considerations and approaches sequence reforms for better risk management, for implementing reforms that the key is to start by gathering information. A customs administration generates numerous aim to improve the business To establish the context, data are needed benefits by adopting risk management, including on what has been done in the past and the increased protection and efficiency of processes environment. The findings, what the results have been. The second and staff. Customs officers are not required to interpretations, and conclusions step is to introduce an intelligence unit to conduct ineffective inspections--their work has a included in this note are those of use the information, and a third is to link purpose and a better possibility of achieving positive the authors and do not necessarily intelligence assessments to the front line of results, raising job satisfaction. Fewer assets are reflect the views of the Executive operations. Then information from the front required, including staff, which lowers costs. Finally, Directors of the World Bank or the line feeds back into intelligence, enabling a risk management processes and systems enable a cyclical process. customs administration to quickly adjust to changes governments they represent. in the work environment (including employment trends) and legislation. For more information, contact about the Investment Conclusion Uma Subramanian, Global Product Leader, Trade Logistics (usubramanian@worldbank.org). Climate Advisory The New Zealand Customs Service's standardized risk management methodology has enabled it to Services move away from trying to ensure 100 percent Endnote border compliance. Today customs targets 3 The Investment Climate Advisory percent of arriving passengers and 2 percent of 1 Craft refers to ships or aircraft carrying goods Services of the World Bank Group arriving goods for intervention. Meanwhile, 100 into or out of New Zealand, as defined by helps governments implement percent of marine craft (about 6,500 a year) are the Customs and Excise Act 1996. Vehicles reforms to improve their business boarded on arrival, and 3 percent are selected for are considered goods instead of craft because, secondary search activity for risk management as an island, New Zealand cannot be entered environments and encourage and purposes. by car, truck, or bus. retain investment, thus fostering competitive markets, growth, and job creation. Funding is provided by the World Bank Group (IFC, MIGA, and the World Bank) and over 15 donor partners working through the multidonor FIAS platform. iN Practice TRAdE LogISTICS 7 International Finance Corporation World Bank Group www.wBgINvESTMENTCLIMATE.oRg