Deloitte's model: the 2013 blueprint of benefits risk selection

Summary

The role of Deloitte in Benefits risk classification was already reconstructed from the March 2014 advisory report. The underlying design document is now public too: the “Process Description Risk Selection, draft version 1.00” of 11 September 2013, written by a Benefits business analyst and found in the project folder TSL_UT_UITWISSELING\Project Risicoselectie.

What the document describes

The description records that risk selection was organised around the “risk selection RS model of Deloitte”, which made it possible to assess applications “in the present, based on risks” — applications were scored at intake, not merely checked afterwards. It names the “Tool and Model of Risk Selection”, the recalibration of the model, and a training trajectory. The wording is telling: the process provides for “evaluating whether the model still works with the new” data and determining “whether the model is sufficiently trained”. This is no static rule set but a model that learns from its own outcomes and is periodically adjusted — recalibration is an explicit process step in the design. The architectural fringe passes by as well: the “Benefits Business Objects Architecture Model” layer and system names such as BSM and SAS. Risk selection is explicitly positioned as acceleration.

Why this document counts

Three reasons. The date: 11 September 2013 precedes the Deloitte report and virtually every enforcement episode of the scandal — the leading design sits at the start of the chain. The nature: not external advice but the implementer’s own process description — the organisation describing itself while building the machine. The throughline: six years later, on 20 May 2019, the same organisation acknowledges that in this risk selection “nationality was one of the dozens of indicators”. From blueprint to confession, one straight line runs through a single file.

Who the model hit

The 2013 process description depicts a machine; the figures afterwards depict the people who went through it. The risk selection scored every allowance application “in the present”, and the consequences mounted through the organisation’s own enforcement lines: the CAF-11 approach hit 232 families in and around the Hawaii case, the broader collective stoppages of 2013 through 2015 hit the group the parliamentary inquiry later took as the core of the scandal, and the redress total now stands at 44,102 recognised affected parents, out of 69,722 registrations. Of the victims in the original childcare group, 71 percent had a migration background — the group the RS model, with its “dozens of indicators”, hit first and hardest. The count of children grew along to 4,791 children with an out-of-home placement.

The gravity documented elsewhere in this series is visible here too: whoever stood red once, ended up in a circuit of intensive supervision, FSV registration and ultimately the EOS/RIEC line. The 2013 application score was the front door of that circuit.

The oversight that did nothing

That this could keep growing was not because oversight stayed silent. The Dutch Data Protection Authority fined 2.75 million euros for the FSV as early as July 2020 — the registration system feeding the risk selection. And in July 2025 the DPA demanded again, this time the immediate phase-out of the KTA and the Information Template, two systems the watchdog said carried the same risks as the banned RAM. The Belastingdienst ignored that demand: the systems kept running, its own planning names replacement in 2027 — two years after the order. On top of that, the state secretary declared in December 2025 that there was “no reason” to assume citizens had been harmed. The pattern is consistent: fines are paid, orders lie still, the machine keeps running. This blueprint belongs in that pattern too — it shows the organisation knew, while building, what it was building.

Frequently asked questions

What is Deloitte’s RS model?

The risk selection model Benefits used from 2013 to score applications for risk at intake; the model was trained and periodically recalibrated.

What is the 2013 Process Description Risk Selection?

The internal design document of 11 September 2013 (document 00933) in which the Belastingdienst describes building risk selection around the Deloitte model.

Was the Deloitte model a learning algorithm?

Yes: the process description explicitly provides for training and recalibration of the model on new data.

How many families did the selection ultimately hit?

Redress counted 44,102 recognised affected parents; 71 percent of the original group had a migration background.

References

1. Process Description Risk Selection version 1.00, 11 September 2013 — Childcare Allowance Information Point
2. Open Brief: Benefits Risk Classification and Deloitte 2013
3. Open Brief: The confession of 20 May 2019
4. Open Brief: The archive nobody read

Investigation based on public sources. Corrections and additions are welcome via the contact page.