Accountability, Transparency, and Legitimacy

Why this matters in public value

A public body can pass every audit, publish every disclosure the statute requires, and still watch its support collapse the moment citizens conclude that nobody with independent standing is really checking what it does. Conversely, a body can miss a filing deadline or bend a procedural rule and lose almost nothing, because its citizens and overseers trust that its intentions and competence are sound. The gap between these two outcomes is the subject of this topic: legality is a floor, not a foundation, and the floor alone does not hold an organisation's authority up.

Topic 1.2 named legitimacy and support as one leg of Mark Moore's strategic triangle — the authorising environment an organisation needs to keep permission to act (see Topic 1.2 — The Strategic Triangle: Legitimacy, Value, and Capacity). That topic treated legitimacy as a strategic input to be mapped and managed. This topic goes underneath it, to the machinery that actually produces or withholds legitimacy over time: the accountability relationships that let citizens and independent bodies check what an organisation does, the transparency regimes that give those relationships something to check, and the audit and oversight institutions that turn scrutiny from a hope into a routine.

The stakes have grown, not shrunk. Citizens increasingly experience government through data breaches, leaked internal messages, and viral clips of single decisions rather than through annual reports, so an accountability structure built only for formal, periodic reporting is answering yesterday's question. A leader who understands the difference between legality and legitimacy, and who builds accountability and transparency as continuous practices rather than compliance events, holds authority that survives a bad news cycle. A leader who does not finds that a technically defensible decision is no defence at all once the public has decided the process itself was not trustworthy — and that decided public judgement is, in aggregate, the institutional trust this topic's mechanisms are built to sustain (see Topic 4.2 — Trust in Government and Civic Engagement).

Core concepts

Accountability is the obligation to explain and justify conduct to someone with standing to ask, and, where the answer falls short, to face consequences. It has three components that are easy to state and hard to sustain together: answerability (the duty to report and explain), enforcement (the capacity of the asking party to impose a consequence), and a clear line of who owes an account to whom. An organisation can satisfy the first component constantly while the second stays empty, because nobody asking has power to act on a bad answer; that combination is accountability in name only (see accountability).

Vertical accountability runs between citizens and those who hold power on their behalf, most visibly through elections, but also through referendums, petitions, and direct constituent complaint channels that let the public reward or punish office-holders without an intermediary institution. It is called vertical because it runs, in principle, straight up from the governed to the governing, through the chain of delegation Topic 1.2 described as a principal–agent relationship, where agents' interests and information never perfectly match their principals' (see Topic 1.2 — The Strategic Triangle: Legitimacy, Value, and Capacity). Vertical accountability is powerful but coarse — an election bundles judgement on hundreds of decisions into one binary choice, held only periodically, which is precisely why it cannot be the only mechanism an accountable system relies on.

Horizontal accountability runs sideways, between state bodies of roughly equal formal standing, none of which is the public directly: courts reviewing executive action, auditors examining spending, ombudsmen investigating maladministration, anti-corruption commissions, freedom-of-information tribunals, and legislative committees scrutinising ministers between elections. These bodies typically operate under some form of separation of powers, the principle that legislative, executive, and judicial functions stay institutionally distinct so that one arm can check another without simply overruling it through hierarchy. Horizontal accountability is what makes accountability continuous rather than only electoral, operating in the years between votes on decisions too technical or fast-moving for the electorate to review directly — which is why its independence from the bodies it scrutinises is not a nicety but the entire point.

Freedom of information is the principle, and increasingly the statutory right, that the public may request and receive documents and records held by government bodies, subject to defined and narrow exceptions rather than to official discretion (see freedom of information laws by country). Regimes differ sharply in strength: some presume disclosure and put the burden on the withholding body to justify an exemption case by case, while others presume secrecy and list narrow categories where disclosure is permitted — a structural difference that matters more than whether a law exists at all. The Global Right to Information Rating, maintained jointly by Access Info Europe and the Centre for Law and Democracy, scores national laws against that structural criterion, which is why two countries can both claim a freedom-of-information law while operating under very different real obligations to disclose.

The transparency, security, and privacy trade-off. Disclosure is not a free good. Publishing raw data can expose individuals to re-identification, reveal information that assists fraud or security breaches, or chill the frank internal advice a decision-maker needs before a decision is final. Mature freedom-of-information and open government regimes handle this by naming the trade-off explicitly — narrowly drawn, time-limited exemptions, a public-interest test weighing disclosure's benefit against its cost case by case, and a right of appeal to an independent body when a requester believes an exemption was misused. A regime that treats every exemption as self-evidently justified, or every exemption as illegitimate, fails the trade-off alike; the discipline is in the narrowness and the appeal, not in whether exceptions exist.

Supreme audit institutions are the independent national bodies charged with auditing how public money is raised, spent, and accounted for — a category spanning very different constitutional forms, from a legislative agency to a court of accounts to an independent auditor-general (see supreme audit institution). Examples include the National Audit Office (United Kingdom), which reports to Parliament rather than the government it audits, and the United States Government Accountability Office, a legislative-branch agency serving Congress. What unites the category, as the International Organization of Supreme Audit Institutions' founding 1977 Lima Declaration set out, is functional, organisational, and financial independence from the bodies being audited — an auditor who can be defunded or dismissed by the entity it audits is not, in any meaningful sense, independent (see International Organization of Supreme Audit Institutions).

Legitimacy versus legality. Legality is technical conformity with binding law: a decision taken by the right person, through the right process, within the powers actually granted. Legitimacy is broader and softer — the degree to which those subject to an authority accept its right to exercise power over them, resting on some mix of legal procedure, democratic consent, demonstrated competence, and perceived fairness. The two diverge in both directions: a technically lawful decision, reached through a process citizens experience as rigged or contemptuous of their concerns, can be legal and illegitimate at once, while an emergency action taken slightly outside strict legal authority, but seen as necessary and honestly explained, can retain legitimacy despite the legal question mark. Topic 1.2 — The Strategic Triangle: Legitimacy, Value, and Capacity — treated legitimacy as an input an organisation manages; this topic's point is that legitimacy is produced, day to day, by whether accountability and transparency are real rather than performed. The rule of law — that law is clear, applied consistently, and binds the powerful as much as everyone else — is a major legitimacy source, but not the only one, and treating legal compliance as a complete substitute for legitimacy is the single most common error this topic addresses.

Oversight actors. An ombudsman investigates individual complaints of maladministration and, cumulatively, surfaces systemic problems no single complaint would reveal; unlike a court, an ombudsman typically cannot compel a remedy, relying instead on the reputational cost of a public finding. Whistleblowing — an insider reporting wrongdoing they have direct access to because they work inside the organisation — is a distinct channel again, catching what neither periodic audit nor citizen complaint reliably catches: wrongdoing actively concealed from both. Regulators sit in a related but distinct position, discussed fully elsewhere (see Topic 3.10 — Regulation and Public Risk Management); this topic's concern is oversight of the state by other parts of the state and by the public, not the state's oversight of external actors.

Best practices

1. Publish the reasoning behind a decision, not only its outcome. A decision announced without its rationale invites the public to supply its own explanation, which is rarely charitable; publishing the actual trade-offs considered converts a suspicious silence into a defensible record.
2. Build a freedom-of-information response function that treats disclosure as the default, not the concession. Design the request process to identify the narrowest lawful exemption rather than the broadest plausible one, and log every refusal with its specific legal basis so patterns of over-withholding become visible to internal audit.
3. Keep the auditor's line of funding and appointment institutionally separate from the audited body. An audit function that depends on the goodwill of the entity it reviews for its budget or its head's tenure is not independent in substance, whatever its title says on paper.
4. Give an ombudsman or equivalent complaints body a public track record, not only a caseload. Publish thematic findings periodically, not only individual case outcomes, so recurring systemic issues are visible to the legislature and the public, not buried in closed files.
5. Separate the person who decides from the person who reviews the decision, at every level that matters. Horizontal accountability collapses quietly when a reviewer reports, formally or informally, to the person whose decision they are reviewing.
6. Treat a whistleblower channel as an accountability asset to protect, not a risk to manage down. A credible, retaliation-free channel is often the only route by which actively concealed wrongdoing surfaces at all; a channel that quietly punishes disclosure teaches staff to stop using it, at exactly the moment concealment is most likely.
7. State the legal basis and the legitimacy case for a contested decision separately, in plain language. Citizens can accept 'this was legally within our power but we recognise it will feel unfair, and here is why we judged it necessary' far better than a decision defended only by citing the statute that permitted it.
8. Give reviewing and audit bodies enough lead time to be substantive, not ceremonial. A statutory consultation or audit window too short to produce a real finding functions as a legitimacy exercise rather than a check, and stakeholders notice the difference.
9. Report against transparency commitments on the same cadence as financial results, not as a one-off initiative. A transparency programme announced once and never revisited signals that disclosure was a launch event, not a standing practice.
10. Close the loop on oversight findings publicly, including the ones that are inconvenient. Publish what changed as a result of an audit, an ombudsman finding, or a freedom-of-information disclosure; an oversight finding with no visible consequence teaches everyone watching that oversight is decorative.
11. Pressure-test a major decision against the public-interest exemption before, not after, a request forces the question. Ask explicitly what would need to be withheld and why, at the point of decision, rather than only when a request arrives and the answer looks defensive.
12. Distinguish, in your own internal language, a legality review from a legitimacy check, and run both. A lawyer confirming a decision is lawful has not confirmed it is wise, fair, or likely to be accepted; commissioning only the first review and treating it as covering the second is a recurring, avoidable failure.

Questions to discuss with your team

Where in our organisation does horizontal accountability exist on paper but not in practice? A review, audit, or oversight function can exist formally while being under-resourced, reporting informally to the body it reviews, or scheduled so late in a process that its findings cannot change anything. Use this question to list every horizontal accountability mechanism your organisation is subject to — internal audit, external audit, an ombudsman, judicial review, a legislative committee — and rate each honestly on independence and timing, not on whether it exists. Discuss which of these would survive a determined attempt to route around it, since that is the real test of independence. Consider, too, whether the people staffing these functions believe their findings lead to consequences, because a demoralised oversight function is a warning sign long before it is a public scandal.

Can we point to a recent decision that was legal but that we would now describe, honestly, as having strained our legitimacy? Most organisations are carrying at least one example of a technically defensible decision that cost more public trust than its legal team anticipated. Use this question to surface it directly, rather than letting it stand as an unexamined near-miss. Discuss what a legitimacy check, run alongside the legal review, would have flagged that the legal review alone did not. This is not an exercise in blame; it is a way of calibrating how your organisation currently distinguishes 'we are allowed to' from 'we should.'

How would our freedom-of-information function behave if disclosure, not withholding, were treated as the default outcome to be measured? Many organisations measure freedom-of-information performance by response time and legal defensibility of refusals, rarely by the proportion of requests met with substantive disclosure. Use this question to look at your actual refusal rate and the exemptions most commonly cited, and ask whether the pattern suggests careful case-by-case judgement or a standing institutional reflex. Discuss what would need to change operationally, not just rhetorically, to shift that default, and what risk that shift would genuinely introduce.

If a whistleblower inside our organisation saw something seriously wrong today, would they use our reporting channel, and why or why not? The existence of a policy is not evidence that people trust it enough to use it. Use this question to discuss, honestly, what has happened the last time someone raised a serious internal concern, formally or informally, and whether the outcome for that person would encourage or discourage the next one. Consider whether leadership would find out about a serious problem from this channel or from a journalist, because that comparison usually settles the question of whether the channel functions.

Where do we currently let legal sign-off stand in for a legitimacy judgement, and is that substitution safe? Legal review answers a narrower question than most decision-makers realise, and treating it as dispositive on wider legitimacy is a common, quiet failure. Use this question to identify a category of decision — a procurement threshold, a data-sharing arrangement, an enforcement policy — where 'legal cleared it' has effectively closed the conversation. Discuss what a separate, explicit legitimacy question would have added, and who should be responsible for asking it going forward.

Which of our independent oversight relationships would we most regret weakening under short-term pressure, and are we protecting it accordingly? Budget pressure, restructuring, and a desire for speed all create quiet, individually reasonable pressure to shrink the resourcing or independence of audit, review, and complaints functions. Use this question to identify which oversight relationship your organisation would most regret having weakened if a crisis exposed the gap later. Discuss what a credible commitment to protecting it would look like in the next budget or restructuring cycle, not only in a policy statement.

In practice: a public value example

A regional environmental agency — fictional, illustrative of a pattern rather than a report on any real body — had spent two years building a permitting system that let it approve routine industrial discharge permits faster, cutting average processing time from eleven weeks to nine days. Internally, the change was judged an unambiguous success: applicants were satisfied, the backlog had cleared, and every approval had gone through a documented legal checklist confirming each permit met the statutory discharge limits in force.

A local journalist, using a freedom-of-information request, obtained the agency's internal approval logs and found that the faster process had removed a step: an independent technical reviewer, previously required to check discharge-monitoring assumptions against real river-flow data before sign-off, had been made optional under the new system to save time, with the checklist itself now serving as the sole gate. Every approved permit was still, on paper, fully legal — the statutory limits had been applied correctly in every case the agency later re-examined. But residents downstream, who had noticed a change in water quality that predated any confirmed breach, read the story as proof that the agency had quietly weakened its own scrutiny to hit a speed target, and local council members who had championed the faster process found themselves unable to explain, in a public meeting, why the independent check had been dropped rather than merely sped up.

The agency's first response — reiterating that every permit was legally compliant — made the situation worse, because it answered a question nobody downstream had actually asked; residents were not disputing legality, they were disputing whether the agency could still be trusted to catch a problem before it became a breach. The agency's second response worked better: it reinstated the independent technical review as mandatory for a defined risk category of permits, published the reasoning for the original change alongside the reasoning for reversing it, and invited its regional ombudsman equivalent to review the permitting process going forward with standing access to approval data rather than only investigating individual complaints. Processing times rose from nine days to nineteen — still far faster than the original eleven weeks — but the agency's support in the affected communities recovered over the following year in a way that repeating the legal-compliance argument never achieved. The lesson the agency drew, and later cited in its own annual report, was that it had optimised a legal and operational metric while quietly removing a mechanism that its authorising community experienced as the actual source of trust.

Four sector lenses

Local government

Local accountability is unusually direct: residents can attend the meeting where a decision is made, and local media, where it still exists, covers a single council decision in more depth than any national outlet would. This directness raises the stakes on freedom-of-information handling, because a slow or grudging response to a local resident's request is more likely to become personally, visibly reported than an equivalent delay nationally. Horizontal accountability is often the thinnest leg locally — a small authority may lack dedicated internal audit capacity, leaning instead on shared regional audit arrangements or a national audit body's local-government remit, which makes protecting that external relationship especially important.

National government

National bodies typically operate the fullest set of horizontal accountability institutions — a legislature, a supreme audit institution, courts exercising judicial review, an ombudsman, and often a dedicated freedom-of-information tribunal — but this density can create a false sense that one mechanism's failure is always covered by the others. National-level legitimacy crises usually follow the pattern of the worked example above: a technically legal decision that an independent body, or a journalist using freedom-of-information law, later reveals was reached by quietly narrowing the scrutiny applied to it. National governments also carry disproportionate responsibility for the transparency, security, and privacy trade-off, since national-security and law-enforcement exemptions to disclosure are broadest and most consequential here, making a credible, independent public-interest test especially important.

Social sector and nonprofit

A nonprofit organisation rarely faces statutory freedom-of-information obligations, but it faces a parallel structure through its charity regulator, its funders, and its board, and increasingly through voluntary transparency commitments donors and the public now expect regardless of legal requirement. Vertical accountability is structurally weaker here than in government, because the people who fund a nonprofit — donors, foundations, grant-making bodies — are frequently not the people it serves, so the 'electorate' that can withdraw support is not the population whose interests the organisation exists to serve. This makes horizontal mechanisms — an independent board, external audit, a functioning whistleblower channel — disproportionately important, since the people best placed to know something has gone wrong often have the least formal power to act on it.

Multilateral and international

Multilateral bodies answer to member states rather than a single public, which stretches both vertical and horizontal accountability: there is no electorate to vote a secretariat out, and the bodies best placed to provide horizontal scrutiny — an internal audit office, an inspector-general, an independent evaluation unit — are themselves funded and staffed within the organisation they oversee, raising exactly the independence question the Lima Declaration addresses for national audit bodies. Legitimacy here is frequently contested on representational grounds before performance grounds — whose consent should count, and in what proportion — so a multilateral body can satisfy every formal accountability requirement in its charter and still face a persistent legitimacy deficit rooted in the charter's own representativeness (see Topic 1.2 — The Strategic Triangle: Legitimacy, Value, and Capacity).

Common failure modes

Legality substitution. An organisation treats a lawyer's confirmation that a decision was lawful as equivalent to confirming it was legitimate, and stops asking the second question once the first is answered. The cost surfaces as public anger that the organisation experiences as unfair, because internally the decision was 'clean' — the gap is invisible from inside the legal-review process that produced it.

Oversight capture. A horizontal accountability body becomes, gradually and often without any single corrupt act, dependent on the goodwill of the body it oversees — for budget, for access, for the continued cooperation an audit or review needs to function. The cost is a slow loss of real independence that is hard to see from outside until a major failure passes through unchallenged and the question of where the check was becomes unavoidable.

Transparency theatre. An organisation publishes extensively — dashboards, open-data portals, regular reports — while the disclosures that would actually let an outsider judge a contested decision remain unpublished or heavily redacted. This costs credibility sharply once discovered, because extensive but curated disclosure reads, in hindsight, as more deliberate than silence would have.

Whistleblower chilling. A formal reporting channel exists, but the organisation's actual response to past disclosures — subtle career consequences, prolonged investigations of the reporter rather than the report, or simple institutional silence — teaches staff that using it carries personal risk for uncertain benefit. The cost is invisible until a scandal breaks that an insider had, in fact, tried to report earlier through the very channel built to catch it.

Accountability without enforcement. A body must explain itself to an overseer, satisfying the answerability half of accountability, but the overseer has no meaningful power to impose a consequence for a poor answer. This produces the appearance of accountability — hearings, reports, findings — without its substance, and it is often mistaken for functioning oversight precisely because the process looks correct.

Maturity model

Checklist

• List every horizontal accountability body your organisation answers to, and rate each on real independence, not formal status.
• Confirm the funding and appointment of your external audit function is institutionally separate from the bodies it audits.
• Review your freedom-of-information refusal rate and most-cited exemptions for signs of a default-to-secrecy habit.
• Confirm a public-interest test, with a route to independent appeal, exists for every disclosure exemption you rely on.
• Test whether your whistleblower channel has been used in the last year, and what happened to the people who used it.
• Identify one recent legal-but-contested decision and run a retrospective legitimacy check on it.
• Separate, in writing, your legal-review process from your legitimacy-review process for major decisions.
• Publish what changed as a result of your last audit, ombudsman finding, or major freedom-of-information disclosure.
• Check that reviewers of a decision do not report, formally or informally, to the decision-maker they are reviewing.
• Identify which oversight relationship would be weakened first under budget pressure, and decide now whether that is acceptable.
• Confirm your transparency reporting runs on a fixed recurring cadence, not as a one-off initiative.
• Ask your team the six discussion questions above and record where the honest answer differs from the official one.

Key sources

• INTOSAI (International Organization of Supreme Audit Institutions), the Lima Declaration (1977) and its material on the independence of supreme audit institutions.
• OECD Recommendation of the Council on Open Government (2017) and the OECD Public Integrity Handbook.
• Access Info Europe and the Centre for Law and Democracy, the Global Right to Information Rating.
• UK National Audit Office and US Government Accountability Office material on independent public-sector audit and Government Auditing Standards.
• Guillermo O'Donnell's work distinguishing vertical and horizontal accountability in democratic theory.
• Mark H. Moore's strategic triangle (see Topic 1.2 — The Strategic Triangle: Legitimacy, Value, and Capacity) as the framing this topic builds on.

References

1. Accountability — Wikipedia — https://en.wikipedia.org/wiki/Accountability
2. Separation of powers — Wikipedia — https://en.wikipedia.org/wiki/Separation_of_powers
3. Freedom of information laws by country — Wikipedia — https://en.wikipedia.org/wiki/Freedom_of_information_laws_by_country
4. Open government — Wikipedia — https://en.wikipedia.org/wiki/Open_government
5. Supreme audit institution — Wikipedia — https://en.wikipedia.org/wiki/Supreme_audit_institution
6. National Audit Office (United Kingdom) — Wikipedia — https://en.wikipedia.org/wiki/National_Audit_Office_(United_Kingdom)
7. Government Accountability Office — Wikipedia — https://en.wikipedia.org/wiki/Government_Accountability_Office
8. International Organization of Supreme Audit Institutions — Wikipedia — https://en.wikipedia.org/wiki/International_Organization_of_Supreme_Audit_Institutions
9. Legitimacy (political) — Wikipedia — https://en.wikipedia.org/wiki/Legitimacy_(political)
10. Rule of law — Wikipedia — https://en.wikipedia.org/wiki/Rule_of_law
11. Ombudsman — Wikipedia — https://en.wikipedia.org/wiki/Ombudsman
12. Whistleblower — Wikipedia — https://en.wikipedia.org/wiki/Whistleblower
13. Independence of supreme audit institutions and the Lima Declaration — INTOSAI — https://www.intosai.org/focus-areas/independence.html
14. Recommendation of the Council on Open Government (2017) — OECD Legal Instruments — https://legalinstruments.oecd.org/en/instruments/OECD-LEGAL-0438
15. Public integrity — OECD — https://www.oecd.org/en/topics/public-integrity.html
16. Global Right to Information Rating — Access Info Europe and Centre for Law and Democracy — https://www.rti-rating.org/
17. Yellow Book: Government Auditing Standards — U.S. Government Accountability Office — https://www.gao.gov/yellowbook
18. National Audit Office — UK National Audit Office — https://www.nao.org.uk/