Whose levee was it?

On 29 August 2005 Hurricane Katrina came ashore on the United States Gulf Coast. In New Orleans, the storm surge and the failure of levees and floodwalls flooded about 80 percent of the city. The US National Hurricane Center's report, revised in 2023, counts 1,392 deaths linked to the storm; earlier counts had given more than 1,800. Most of the direct deaths were in Louisiana. The hazard was severe, but investigations afterwards, including a US House of Representatives select committee, found that many of the failures were failures of governance as much as engineering. The levees had been designed and built by the US Army Corps of Engineers to standards set by Congress, but were maintained by local levee boards. Funding, design standards, maintenance, evacuation planning and emergency response were spread across federal, state, parish and city bodies with different mandates, budgets and information. When the storm came, no single institution held the whole picture, and the coordination that was needed had not been agreed in advance.

The point is not to assign blame to a particular agency. It is that a risk which crosses organisational lines is governed by the rules, relationships and habits among the organisations, not only by the technical quality of any one of them. A levee that is strong on paper can fail because the people responsible for it were not responsible for the evacuation, and the people responsible for the evacuation did not know the levee's condition.

This is what risk governance studies. It asks who is involved and with what mandates, what counts as a risk worth addressing and on whose evidence, how decisions are taken, with which instruments they are carried out, and how the people who decide are held to account and learn. This lesson sets out the concept and the main questions, and the rest of the course gives you frameworks and tools to answer them.

Government, governance and management

Risk governance covers the actors, rules, conventions, processes and mechanisms through which information about risk is collected, analysed and communicated, and through which decisions about risk are taken and implemented. It is broader than what a government does: companies, insurers, scientists, the media, communities and international bodies all shape how risks are handled. It is also broader than risk management, the activities within an organisation or system to identify, analyse, evaluate and treat risks, which is described in the international standard ISO 31000. Risk management operates inside a governance context that it does not control: the laws that apply, the expectations of regulators, the willingness of the public to tolerate a risk.

International frameworks have placed governance at the centre of risk reduction. Priority 2 of the Sendai Framework for Disaster Risk Reduction 2015 to 2030 is "strengthening disaster risk governance to manage disaster risk", and the Organisation for Economic Co-operation and Development (OECD) adopted a Recommendation on the Governance of Critical Risks in 2014, which sets out expectations for national governments on identifying and assessing critical risks, on institutions and on communication and financing. Both texts start from the observation that the technical means to reduce many risks exist; what is often missing is the arrangement of responsibilities, incentives and accountability that puts them to use.

Five families of questions

Governance questions can be grouped into five families, and the rest of this course returns to each. Who is involved, and with which mandates? Mandates may overlap, leave gaps or conflict. What counts as a risk worth addressing, and on whose evidence? Risk is framed by choices about what to measure, over what horizon and who counts as affected. How are decisions taken: by rule, by negotiation, by deliberation or by default? With which instruments are decisions implemented: regulation, money, information or direct provision? And how are decision makers held to account, and how do they learn?

The questions are also a diagnostic tool. When something goes wrong, a useful first step is to ask which family of question the failure belongs to. A warning that did not reach people is usually a "who" and "how" failure: nobody had the mandate to issue it, or the channel did not exist. A building code that was not enforced is a "with which instruments" failure. A hazard map that sat in a drawer is an "accountability and learning" failure.

Worked example (hypothetical): mapping mandates for one risk

Take a city's river flood risk and list the actors and what each is responsible for. The national water agency sets flood hazard maps and design standards. The provincial government funds embankments within its territory. The city council controls land use and building permits. The utility owns pumping stations. The civil protection agency issues evacuation orders on request of local authorities. The meteorological service issues weather warnings but not flood warnings. The river basin organisation coordinates reservoir releases. Seven actors, each with a different mandate.

Now build a simple responsibility matrix with the five activities of managing the flood: assess (know the hazard), prevent (reduce the hazard or exposure), prepare (warning, plans, drills), respond (evacuate, rescue) and recover (rebuild). For each activity, mark which actors are responsible with a R (responsible), S (supports) or leave blank.

Suppose the analysis shows that assess has two responsible actors (the water agency and the meteorological service) whose maps and forecasts are not combined; prevent has three (provincial government, city council, utility) with no one responsible for the whole; prepare has one (civil protection) who depends on the other two for information; respond has one; and recover has none, because reconstruction is funded by a national ministry that is not on the list. Counting cells: of the 5 activities, 1 has a clear single owner, 2 have fragmented ownership, 1 depends on others' information, and 1 has no owner. That is 20 percent clear ownership. The exercise does not tell you what to do, but it tells you where to look: the gaps and overlaps are where failures of governance occur.

Answers. With assess and recover now clearly owned, plus respond, three of five activities have a single clear owner, or 60 percent. Fragmentation remains in prevent and dependence in prepare. The Katrina case raises mainly the who and how questions: responsibility for design, maintenance and evacuation was split across bodies with no single holder of the whole picture, and the coordination had not been agreed in advance. It also raises accountability: afterwards, investigations asked who should have known the condition of the levees.

Why governance matters more as systems become connected

Governance matters most where risks cross boundaries. A flood that starts in one province and peaks in another, a pandemic that moves between countries, a cyber attack that spreads through suppliers, a power failure that stops water pumping: each falls between the mandates of institutions designed for single sectors or territories. Many of the great failures of risk management of recent decades have been failures of such "between" spaces. This is the territory that the Nexus lens, taught in the last module, is designed to cover. For now it is enough to say that the frameworks you meet in the next lessons are tools for seeing the whole arrangement, not only its parts.

Applying the five questions to a familiar risk

The five families of questions are easiest to understand when they are applied to a risk that most readers know, such as flooding from a river. On who, the answer is rarely a single organisation. A national water agency, a weather service, provincial and municipal governments, utilities, insurers, emergency services, landowners, community groups and the households themselves all take decisions that shape the outcome. On what, a flood risk assessment has to choose a return period to plan for, a boundary of the area to study and the assets and people to count, and each choice excludes something. On how, there are procedures for approving development in a floodplain, for issuing warnings, for declaring an emergency and for releasing funds, and the speed and clarity of these procedures matter as much as their content.

On instruments, governments choose among building codes, land use zones, taxes, subsidies, insurance rules, information campaigns and public works, and the combination in use is usually the product of history more than design. On accountability, the question is who must explain a decision to leave an area unprotected, to whom, and with what consequence. Stated this way, the questions turn a vague complaint such as "flood management is poor" into a set of specific, checkable statements. Each can be answered with documents, interviews and data, and each leads to a different kind of remedy.

What a strong answer looks like. A strong matrix names specific institutions, not "the government", and distinguishes legal responsibility from actual practice. The best answers admit where they are unsure who is responsible, since that uncertainty is itself a finding. The three questions should point to evidence you could look for, such as a law, a budget line or an interview.