Managing Risk for Your Municipality

Municipalities are charged with keeping employees prepared and keeping cities and towns safe. How hard can it be? Very hard. And getting harder.

Risks have multiplied. It started in the late 1970s when liability increased exponentially with the loss of municipal immunity from unlimited liability for negligent acts or inactions by municipal employees. Today, litigation costs continue to soar. Internet exposure has brought with it new threats to data confidentiality, operational continuity and financial predictability. Social media and email create new ways to inadvertently break open meeting laws, public record laws and freedom of information requirements. Stanley Corcoran, Executive Vice President of three Massachusetts interlocal insurance association organizations, assesses the resulting predicament: “[C]ities and towns face huge unfunded liabilities and simply do not have the resources to stay on top of them all.”

If your municipality is struggling, you are not alone. Experts share the following tips for managing the multiple risks that counties, cities and towns are facing.

  1. Assess and improve computer security systems. Hot targets for cybercrime, municipalities cannot afford lackluster security. They should store all documents off “the cloud,” opting instead for a cloud-based private server. Their software should come with robust 256-bit encryption that makes it harder for hackers to get at sensitive data.
  2. Educate all of your stakeholders on risk mitigation. The municipality’s armor against risk is as strong as its weakest link. The leading cause of data breaches is insider negligence or malfeasance. Boards, which handle your most sensitive information and bear ultimate responsibility, should receive regular training (at least twice a year, preferably four times a year) plus more frequent tabletop exercises for reinforcement and review. They must know how to keep their communications impenetrable and how to shelter the sensitive documents that they handle.

Employees also need training. All employees should learn cybersecurity protocols. Staffshould be trained routinely on best practices for safety in their respective domains, be itdriving emergency vehicles, “talking down” difficult constituents or policing specialevents.

Teaming up with neighboring cities and towns can reduce the cost of such training while creating a mutual aid network. Essex, MA, has partnered with four nearby towns to get training on emergency preparedness. It has created efficiencies, as expected. The surprising benefit was that the resulting network has proven essential in the aftermath of emergencies, before long-term assistance arrives.

  1. Adopt sound governance practices and ensure their continuity. To reduce the risk of divulging personal identifying information, health records or student information, municipal boards should systematically segregate public documents from board reports containing confidential information. Good board portal software automates this discipline.

Municipalities also run the risk of breaking open meeting laws in new and surprising ways. Banning board emails prevents inadvertent electronic “meetings” that many states have deemed breaches of open meeting laws. Texting between board members can have the same effect. Both emails and texts on popular unsecured apps further expose sensitive data to the risk of data theft or system corruption. Board communication should be confined to messages conveyed over a secure board portal and texts sent over a secure app that replaces what comes pre-loaded on many smartphones.

Open record laws increasingly call for posting much more than meeting minutes and agendas online; the voluminous “public records” can now be stored on the internet. As more states call for electronic archiving of public records, these records should be stored in a secure location with searchability to give researchers a fair shot at finding what they’re looking for.

Complying with Americans with Disabilities Act (ADA) requirements shields municipalities from potentially embarrassing federal investigations. As these regulations change frequently, the best bet is to use board portal software from a vendor that has its finger on the pulse of disability accommodation legislation. Ideally, a software company will have an active partnership with the Office of Civil Rights to stay as up-to-date as possiblewith new revisions to requirements. (Beware false prophets! Claims of compliance are often unfounded, and the software company itself may not realize it.)

It’s not enough to adopt these best practices in governance; ensuring their continuity is a growing challenge. The Massachusetts Interlocal Insurance Association (MIIA)has recently seen a high rate of turnover in municipal leadership due to retirements. New leaders will lack a deep understanding of the municipality’s governance practices; they may not even know what those policies are. Always include more than one or two people when you determine and review your governance strategy to ensure continuity. Make sure some younger officials are in the room alongside seasoned veterans.

  1. Create a culture focused on safety. Public safety must become a natural priority in every department. In all areas that affect the safety of people, buildings or data, pro-active municipalities provide training in concrete techniques to mitigate risk. Repetition makes any learning automatic; it’s a good idea to follow the lead of the town that supplements a full course of regular training with mini-training “tailgates” for reinforcement and review.
  2. Promote employee well-being. Healthy employees are better able to implement best practices, avoid accidents and respond effectively to a crisis. It’s a good investment to give free employee training opportunities related to physical and mental health, safety and well-being. Employee assistance programs (EAPs) often offer mental health services. One town offers free classes on healthy cooking and stress management.
  3. Predict and prevent. New threats present themselves all the time, as do mitigation strategies. Use data analysis, trend analysis and sharing of best practices to prepare for the worst. MIIA offers grants for some pre-emptive measures, such as data security audits and emergency response trailers.
  4. Take advantage of insurance programs. In a growing trend, insurance companies are offering municipalities not only traditional policies, but also incentives for municipal leaders to actively reduce their exposure to risk. Also, self-insurance groups (SIGs) cover gaps in traditional coverage; if your municipality is one of the few that does not already use one, seek one out.
  5. Win public trust. The National League of Cities has cited “lack of public trust” as one of the top-10 crises facing cities. Their recent poll found that only 37% of respondents trusttheir local government. If public confidence implodes, it will be nearly impossible to recruit volunteers or implement tax increases. Bitter constituents will also be more likely to file a lawsuit or make a claim against your municipality.

Transparency and communication keep public trust alive. Many steps can help: posting meeting agendas on a user-friendly public-facing website; putting public records online with user-friendly features like searchability; voluntarily filming your own open meetings and posting the video on the same website; and forging new channels of communication to reach segments of the population not traditionally interested in municipal affairs. Online communication can be combined with face-to-face events to reach more young people and homebound constituents.

As risks multiply, you are not helpless. Adopting exemplary practices can significantly reduce your vulnerability. Then you can rest assured that you’ve brought into the 21st century the timeless insight of Cicero: “The safety of the people shall be the highest law.”


Corcoran, Stanley, “The Evolution of Municipal Risk Management,” Risk Management September 21, 2015

Government Finance Officers Association, “Creating a Comprehensive Risk Management Program”

Michael Preis Insurance Agency, “Risk Management and Insurance Programs for Municipalities,”

National League of Cities, “The 10 Critical Imperatives Facing Cities in 2014”

Speak with
a Human

Want to talk to a person who can answer your questions?

Just get in touch with us by phone, or if you prefer email, use our web form.

800-407-0141 or Contact Us Online