The Buffer Is Always Paid

Accept or prepare is not a real choice. The prevailing business logic of recent decades is to strip every margin out of a system: hold no more stock than the next step requires, deliver exactly on time, keep no reserve that costs money. Just-in-time, it is called. It sounds like thrift, but it only shifts the costs of a shock in time and concentrates them — from the balance sheet that pocketed the efficiency gain to the balance sheet that must absorb the break. The buffer is always paid; the question is whether it comes as a flat premium in advance or a jolting bill afterwards, and who gets that bill. At Suez, at Hormuz, in a pandemic, in a war that severs a chain: almost always the government, and within it the groups without margin of their own. The profit of the smooth chain is private; the costs of the broken chain are public.

The 2026 risk scan of the RIVM, the Dutch National Institute for Public Health and the Environment, is the illustration of this without reading itself that way.¹ The three pillars of Dutch stockpile policy — diversification, production closer to home and strategic reserves — are the state putting back the redundancy the market took out. HERA, the EU’s Health Emergency Preparedness and Response Authority, and the Critical Medicines Act: public reinvestment in stock that business wrote off as waste. At the level of execution, the question has thus already been decided. The live question is how much, where, and what keeps the buffer standing when nobody is looking any more.

That last question is the hard one, and the report unintentionally contains the answer. The questionnaire went out in the first months of 2026, while cuts to pandemic preparedness were being debated. The buffer built up after COVID is being cut into before the next shock has arrived. That is the pattern. A working stockpile is invisible, its costs are continuously visible, and in the lull between two crises it erodes predictably. Building up happens after the shock; dismantling happens in the quiet.

The just-in-time state

The error does not stop at the global supply chain. The same logic has been applied to the Dutch state’s own capacity for thirty years. The rotation system of the Senior Civil Service (Algemene Bestuursdienst), which moves top officials to a new post every few years, is just-in-time management of institutional memory: knowledge held in a few carriers who walk out of the door, no redundancy. The flexible staffing shell is just-in-time personnel. “More with less” is the systematic removal of peak capacity, so that every court ruling, every demand spike and every new task instantly becomes a crisis. Decentralisation as cost-shifting is buffer removal under another label, and the “ravine year” — the funding cliff facing Dutch municipalities — is its announced bill.

In a recovery assignment at a municipality in the hundred-thousand-inhabitant range, I saw how little slack was left. The apparatus had been set so tightly against the regular load that the first setback — an absence, an unexpected case file — turned into a derailment. What was missing was margin. The supply chain of medicines and the personnel chain of the state have both been run just-in-time, and fail for the same reason.

Every public task must hold three things in balance at once: the value it creates for society, the capacity to actually deliver it, and the political backing to sustain it. Mark Moore called that the strategic triangle. The practical lesson is that things go wrong as soon as one corner is maximised at the expense of the other two. Just-in-time is the pure illustration. Delivery capacity is optimised on cost, while the public value — here, the certainty that care continues through a shock — is quietly hollowed out. And the third corner explains the persistence: the political space to pay for a buffer in advance exists only briefly after a shock, and evaporates as the urgency subsides.

Two kinds of buffer

Not every buffer is the same buffer, and the report shows two kinds side by side without drawing the distinction. One is physical: face masks, vaccines, medicines, production capacity. That is the buffer being rebuilt and financed — with a structural budget for pandemic preparedness, with HERA, with the Critical Medicines Act. The other is human: the surveillance and response networks, the laboratory knowledge, the epidemiological registration, the people at the RIVM and the municipal health services who can read an outbreak signal before it is an outbreak. And it is precisely that second buffer which, according to the report itself, is eroding. Through cuts to international surveillance, in the report’s own words, knowledge and skill threaten to disappear, so that changes in pathogens are detected more slowly.

Here sits an asymmetry worth dwelling on. A physical stockpile lying unused in a depot is called a strategic reserve, and that sounds like prudence. Human overcapacity waiting unused for a peak is called overhead, and that sounds like fat. The same structural function — reserve you draw on in a shock — with an opposite moral sign. And the asymmetry runs the wrong way, because of the two buffers the human one is the least recoverable. A stock of masks can be reordered; once the political will returns it is a matter of months. A surveillance network and the tacit craftsmanship inside it cannot be rebuilt in months. The expertise leaves with the people, and it takes years to form someone who recognises a signal. The buffer that is cut first and most quietly is thus exactly the buffer that takes longest to get back — and that asymmetry plays out wherever reserve sits in people rather than in money or in things. For this risk scan it means that the reassurance about the physical stockpile is the easy half of the story, and the concern about eroding surveillance the half the document ought to tell.

A bet on stationarity

Beneath the choice sits an assumption about the nature of the risk. The efficiency reasoning is a bet that the distribution of shocks is stable and priceable. Against a priceable distribution you can insure yourself with precision. The concept of polycrisis that the report introduces in its fifth chapter claims the opposite: that the distribution itself is shifting, and that shocks cluster and amplify one another.

Nassim Taleb calls the event that breaks such systems a black swan: not merely rare, but outside the model — something the calculation did not account for, and which lands so hard precisely for that reason. The danger is that the system has been optimised on its absence. His second point is sharper, and it saves the efficiency debate from a fallacy that usually creeps into it. As long as you present redundancy as an insurance premium, you are still calculating with a probability distribution you believe you know. But with what Taleb calls a fat tail — where the rare catastrophe is far more likely than the tidy average model assumes — that premium cannot be calculated at all. Then redundancy is the only sensible posture, for a reason that has little to do with cost-benefit arithmetic: ruin is the end of the game. Whoever falls over no longer plays, however efficient he was in the years before. And there is one step further. The systems that not only survive a shock but come out of it stronger do so because they had slack to fall back on and to reorient with. Overcapacity is not only a wall against the blow; it is the precondition for learning from a shock instead of succumbing to it.

Here the difference between navigating and planning becomes material. The planning reflex provisions against the specific disruption it believes it can foresee. The resilient approach provisions against the category. Predictability is the hinge variable. Fair is fair: for one individual buffer the efficiency bet can come off cleanly — the shock never hits that node and the gain was real. The argument is that across a large number of such single dependencies, in a world less stable than the models assumed, the risk of the rare disaster is mispriced — and that the lost bets land publicly while the won bets have been collected privately.

The test and the carrier

The obvious remedy is the banking stress test, exported to other sectors. The reflex is right, and it is already happening under other names: NIS2 and the Critical Entities Resilience Act force risk analyses, and the Court of Audit’s verdict on the Caribbean Netherlands — no safety net, no strategic stockpiles — is a successful stress test with an unpleasant result. But the most defining feature of the banking test is the least transferable. There, resilience is a single number: capital is measurable, the shock translates into loss in the same unit, and pass or fail is clean. For pandemic preparedness, for a youth care system, for the absorption capacity of a region, that single measure does not exist.

As soon as resilience cannot be expressed in a common unit, the test starts measuring what is countable, and three predictable pathologies set in. The carrier test shifts into a document test, which asks whether the plan is on the shelf. The scenario set becomes a congealed outcome — fixed once and thereafter the target optimised against, while the whole point of the polycrisis is precisely the unimagined shock, and the shocks that arrive together. And the perimeter pushes the risk to the edge: the report shows it itself — the large hospitals fall inside the scheme and are resilient; the general practitioners and physiotherapists outside it are exactly where the risks pile up.

A stress test is, moreover, a blue instrument, in the language of De Caluwé’s colours of change: rational, planned, measurement-based. Resilience, by contrast, has a large white core — the emergent capacity of a system to absorb the unthought on its own strength. A purely blue test measures the buffer you can lay in beforehand, is blind to that capacity for improvisation, and lets it wither by rewarding only the measurable.

What is transferable is the only thing that matters. The deepest function of the banking test is that it makes resilience visible annually and repeatedly. It forces a recurring moment at which the buffer must be looked at, and converts the invisible stockpile into a public number that cannot quietly sink away. That is the antidote to the asymmetry, and the only reason to want the instrument. The rest is scenery.

The discomfort sits in the last link. The banking test bites because the tested party and the carrying party are the same: the bank holds the capital, the bank fails, the shareholder loses. In the supply chain that falls apart. The party that strips the stockpile shifts the risk of the exceptional disaster onto the state, so testing it solves nothing as long as it bears no consequence itself. Then the point of application shifts to the state itself, which must grade its own preparedness for a buffer that, when it works, looks like waste. Nobody likes to sanction themselves on that ground. Banking got its stress test after 2008, imposed from outside.

The report knows more than it does

What stands out about the risk scan is the processing. The report sees it sharply and then lets the countable outcome take the lead. The instrument yields a top fifteen — average risk scores, unweighted — and that stands at the front. The analytically more valuable result, the finding that antimicrobial resistance, climate and disinformation function as nodes connected to a large number of other threats, stands behind it, in chapter five. Anyone who takes it seriously ranks by leverage, because on an average-score scale a node and an endpoint are not comparable. The report contains its own correction and does not let it work back to the front. That is the countability trap in pure form: the countable outcome beats the structure that matters more for decision-making.

The most telling detail sits in the recommendation the report itself presents as its flagship. For the coordination problem it proposes a special envoy — one person, one assignment, one interdepartmental mandate. That is exactly the single dependency it condemns in the medicine chain, now as an administrative instrument, and it is the opposite of anchored, because it evaporates as soon as the appointing minister departs. And “preserving what is good” leans on reputation, the most lagging indicator there is — what remains standing after the substance has already begun to erode. Two findings in one report: the Netherlands is a frontrunner, and the Netherlands is cutting preparedness. That is the form holding firm while the substance is being withdrawn.

The world supplies the shocks free of charge. The buffer it does not — and whoever buys the buffer only once the break is there pays for it anyway, at the highest price, at the worst moment, for the people with the least margin.

---

---

Jacob Huibers is an interim manager with more than twenty years of experience in the Dutch public sector. He has worked as cluster manager, cluster director and quartermaster at municipalities ranging from fifty thousand to over two hundred thousand inhabitants, and at inter-municipal collaborative bodies across the social and physical domains. Statecraft is his platform for strategic reflection on public-sector execution, pillar IV of House of Viridian.

Responses and counter-arguments via Statecraft.nl.

Footnotes

1. RIVM, Risicoscan internationale dreigingen voor de Nederlandse volksgezondheid. Nederland beter voorbereid op de toekomst (Risk scan of international threats to Dutch public health), RIVM report 2026-0039, doi 10.21945/RIVM-2026-0039. The RIVM makes its reports freely available through its library at rivm.nl. ↩