Regulation and Public Risk Management

Why this matters in public value

Every regulator works inside a trap with no comfortable exit. If a preventable harm occurs, the regulator is blamed for having been too lax. If the regulator blocks or delays something later shown to be safe and beneficial, it is blamed for excessive caution that cost jobs, treatments, or investment. Both failures are visible only in hindsight, which means the regulator's real decision is never simply 'safe or unsafe' but 'how much of this risk are we willing to carry, and on whose authority'. An organization that has never written its tolerance down discovers it expensively, the first time something goes wrong and an inquiry asks who decided the risk was acceptable.

Risk appetite statements and risk registers exist to make that tolerance explicit before the event, not after. They convert a private, distributed set of judgement calls — made by inspectors, caseworkers, and duty managers under time pressure — into a stated position the organization can be held to and can defend. Regulatory design does the same work at the level of the rule itself: choosing a command-and-control instrument or a responsive, risk-based one is a risk decision in its own right, not merely a matter of administrative style. This topic treats regulation and risk management as two expressions of one underlying question: how does a public body decide, explicitly, how much harm it will tolerate in pursuit of a public value it also cares about?

A regulator's authority to make that call is not self-granted, which is why this topic sits next to the accountability structures that legitimize it (see Topic 3.4 — Accountability, Transparency, and Legitimacy), and why the risks it identifies today are frequently the crises another team is planning for tomorrow (see Topic 3.12 — Crisis, Emergency, and Resilience Management).

Core concepts

Regulation is the use of rules, backed by some form of authority, to constrain or direct the behaviour of individuals, firms, or other organizations. In the public sector it sits alongside spending and taxation as a core policy instrument, but unlike spending, it typically imposes its costs on the regulated party rather than on the public purse — which is exactly why it can be politically attractive, and why its true cost is easy to underestimate.

Regulatory agencies are the bodies that write, administer, and enforce rules within a defined domain, such as financial conduct, medicines, food safety, or building control. Their design choices — how independent of ministers they are, how they are funded, how appealable their decisions are — shape whether they can act on evidence without being captured by the industries they oversee.

Command-and-control regulation sets uniform, prescriptive rules and penalizes any breach, regardless of the breaching firm's track record or the actual risk it poses. It is transparent and easy to audit, but it treats a persistently careful operator the same as a habitual violator, wasting compliance effort on the former while under-deterring the latter.

Responsive, risk-based regulation differentiates its response by the assessed risk and compliance history of the regulated party: light-touch engagement for good-faith actors, escalating sanctions for repeat or wilful non-compliance. Wikipedia's coverage of this approach, under the heading regulatory risk differentiation, traces it to Ian Ayres and John Braithwaite's 'enforcement pyramid', which starts with persuasion and escalates to licence withdrawal or prosecution only when lighter tools fail. It asks more of a regulator's judgement and data than a fixed rulebook does, which is its principal cost.

Regulatory impact analysis (RIA), also called regulatory impact assessment, is the document a government produces before introducing a new regulation, setting out the problem, the options considered, and the expected costs and benefits of each. Wikipedia's regulatory impact analysis article traces its spread across many countries. Its purpose is to make the trade-off in a proposed rule visible before adoption, not to justify a decision already made — a distinction the failure modes below return to.

Risk management is the discipline of identifying, assessing, and controlling the things that could prevent an organization from meeting its objectives. ISO 31000 is the most widely referenced international standard for structuring that discipline; it treats risk management as an iterative process — identify, analyse, evaluate, treat, monitor — rather than a one-off exercise, and several national frameworks, including the United Kingdom's HM Treasury Orange Book, build on its structure.

Risk appetite is the level of risk an organization is prepared to accept, in pursuit of its objectives, before it acts to reduce that risk. A risk appetite statement makes this explicit and differentiated: a public health regulator might have near-zero appetite for risk to patient safety but a much higher appetite for the reputational risk of an unpopular, evidence-based decision.

A risk register is the operational tool that lists each identified risk, its likelihood and impact, its owner, and the mitigations in place or planned. Used well, it drives resourcing and escalation decisions; used badly, it is a spreadsheet nobody reopens between audits.

The precautionary principle holds that when an action or policy carries a suspected risk of serious or irreversible harm, the absence of full scientific certainty should not be used as a reason to postpone protective measures. In some formulations it shifts the burden of proof from 'prove this is dangerous before we act' to 'show this is safe enough before we proceed' — a genuinely different default that matters most under scientific uncertainty and potential irreversibility, such as a novel chemical, technology, or pathogen.

Proportionality is the principle that a regulatory response should be no more restrictive than necessary to address the risk it targets. It is the main practical and legal constraint on the precautionary principle: precaution justifies acting under uncertainty, but proportionality still governs how much you are entitled to do about it, and for how long.

Best practices

1. Publish a risk appetite statement before you need one. Draft it with your governing body, not only your risk team, so that when a hard call arrives, the tolerance for harm was set in calm conditions rather than decided under public pressure mid-incident.
2. Match the regulatory instrument to the risk profile, not to institutional habit. Reserve command-and-control rules for risks where uniform compliance is genuinely non-negotiable, such as structural safety, and use risk-differentiated approaches where the regulated population's compliance history varies widely.
3. Run the regulatory impact assessment before the decision, not to justify it afterwards. Commission it early enough that its findings could still change the proposal, and publish it alongside the rule so the reasoning is checkable.
4. Size the assessment to the size of the rule. A minor technical amendment does not need the same analytical weight as a rule that reshapes a whole sector; a fixed, disproportionate process just teaches staff to treat it as a formality.
5. Keep the risk register a live, owned document. Assign a named owner to every entry, set a review date, and report movement — new risks, closed risks, missed mitigations — to the board on a fixed cycle rather than only when an auditor asks.
6. Apply a proportionality test every time the precautionary principle is invoked. State explicitly what evidence of harm exists, what less restrictive options were considered, and when the restriction will be reviewed, so precaution reads as a reasoned judgement rather than a reflex veto.
7. Set a sunset or review date on every significant regulation. Left unreviewed, rules accumulate faster than they are repealed, and the compliance burden grows even where the risk they addressed has receded.
8. Separate standard-setting from case-by-case enforcement decisions. Keep enforcement choices reviewable on their own record, so a regulator's overall rules and its decision in one contested case do not get judged, or defended, as if they were the same thing.
9. Guard deliberately against regulatory capture. Rotate senior staff away from the sectors they will later regulate, disclose outside interests, and fund the regulator independently of the fees or fines it levies on the industry it oversees.
10. Make the regulator accountable to a body outside the regulated industry. An appeals route, an inspectorate, or a legislative committee that can question the regulator's decisions keeps its risk judgements honest (see Topic 3.4 — Accountability, Transparency, and Legitimacy).
11. Connect the top of the risk register to emergency planning. The highest-likelihood, highest-impact entries on a risk register are frequently the scenarios that crisis and continuity planning needs to rehearse, so the two functions should read the same document, not maintain parallel ones (see Topic 3.12 — Crisis, Emergency, and Resilience Management).

Questions to discuss with your team

Do we know our own risk appetite, or are we discovering it incident by incident? If nobody in the room can describe, in a sentence, how much risk the organization is willing to carry in its core functions, then every hard call is being made from scratch, by whoever happens to be on duty. That produces inconsistent decisions across similar cases and leaves the organization defending judgement calls it never actually agreed to as a body. Ask where a written risk appetite statement exists today, who approved it, and when it was last tested against a real decision rather than left as an unread policy document.

Which of our regulatory tools are command-and-control out of habit, rather than by deliberate design? Uniform rules are easier to write and defend than differentiated ones, which is exactly why organizations default to them even where the regulated population's risk profile varies enormously. Walk through your major regulatory powers and ask, for each, whether a risk-based or responsive alternative was ever considered, or whether the current instrument simply predates the question being asked.

When did we last update our risk register, and who owns each entry on it? A register with no named owners, or one that has not moved since the last audit, is not managing risk — it is documenting that risk was once discussed. Ask the team to open the register live in the meeting and account for the top five entries: what has changed, what mitigation is due, and what happens if nobody acts before the next review.

Where have we invoked the precautionary principle, and could we defend that decision as proportionate today? Precaution is easy to invoke and hard to unwind, because reversing a protective measure always looks like relaxing vigilance even when the evidence has moved on. List the live restrictions in place under a precautionary rationale and check each one still has a stated review date and a stated evidential basis, not just institutional inertia keeping it in force.

Who holds our regulatory function accountable, and is that arrangement actually working? A regulator that answers only to itself will, over time, drift towards the preferences of the sector it deals with daily, because that is the only audience giving it regular feedback. Discuss whether your appeals route, oversight committee, or inspectorate has meaningfully changed a decision in the last few years, or whether it exists on paper without ever being tested (see Topic 3.4 — Accountability, Transparency, and Legitimacy).

Does our risk register talk to our emergency plan, or do the two live in different silos? Risk registers are written by risk and compliance teams; emergency plans are written by resilience teams; too often, neither reads the other's document, so the scenario a risk register has been flagging as likely and severe is not the scenario the emergency plan has rehearsed. Ask whether the top of your risk register and the scenarios in your last exercise are the same list, and if not, why not (see Topic 3.12 — Crisis, Emergency, and Resilience Management).

In practice: a public value example

The following scenario is entirely fictional, illustrative of a pattern rather than a report on any real regulator's internal decision-making.

A coastal region's aquaculture regulator — call it the fictional Estuary Fisheries Authority — receives an application from a fish farm operator wanting to introduce a new offshore mussel-and-finfish co-culture technique, already used commercially in a handful of other countries, that promises higher yields with a smaller seabed footprint. The regulator's own marine biologists flag one open question: the technique changes local nutrient flows in ways that, in a small number of studies elsewhere, have been linked to algal blooms harmful to wild shellfish beds nearby. The evidence is suggestive, not conclusive, and the region's wild shellfish fishery is economically and ecologically significant.

Under a purely precautionary instinct, the authority could simply refuse the licence until the science is settled, which might take years and would cost the operator an investment already committed and the region the jobs and export revenue the technique could bring. Under a purely permissive instinct, it could approve the application on the grounds that no harm has been proven, and accept the risk to the wild fishery if the worrying studies turn out to generalize. Neither instinct, on its own, reflects what the authority's — still unwritten — risk appetite would actually say if someone asked it directly.

Instead, the authority's head of licensing insists on three steps before a decision is made. First, a proportionate regulatory impact assessment is run, comparing the approve, refuse, and conditional-approval options against the best available evidence, including a call for further monitoring data from the countries already using the technique. Second, the application is logged as a new entry on the authority's risk register, with an assigned owner, a stated likelihood and impact rating for the algal-bloom scenario, and a mitigation plan built into any approval — a fixed monitoring regime, defined trigger thresholds for suspension, and a review date twelve months out. Third, because a licence granted with a monitoring condition and a suspension trigger is a form of continuing risk, not a closed decision, the authority notifies its regional resilience partnership so the algal-bloom scenario appears in the area's environmental contingency planning rather than being known only to the licensing team.

The authority grants a conditional licence: approval, with mandatory monitoring, a low but explicit threshold for suspension, and a public commitment to review the evidence in a year. The decision is neither a blanket 'no' driven by unproven fear, nor a silent 'yes' that ignores a real signal. It is a stated risk appetite — some risk to the wild fishery is acceptable in exchange for the region's economic benefit, provided it is monitored and reversible — applied consistently and written down where the next licensing officer, and the next audit, can find it.

Four sector lenses

Local government

Local regulators — environmental health, trading standards, building control, licensing — deal with the same premises and the same operators repeatedly, which is exactly the condition under which responsive, risk-based regulation works best: a local inspector can credibly distinguish a first-time paperwork lapse from a persistent risk to public safety. The practical constraint is capacity: a small council team maintaining a genuinely live risk register across hundreds of licensed premises, on top of enforcement casework, needs the register to be simple enough to actually use, not a template imported from a much larger national body.

National government

National economic and safety regulators — competition authorities, financial conduct regulators, medicines agencies, health-and-safety bodies — operate at a scale where a full regulatory impact assessment is standard practice and often a legal requirement, and where the precautionary principle appears explicitly in statute for domains such as pharmaceuticals and food safety. National risk registers, compiling the highest-likelihood and highest-impact risks a country faces, are a direct input to national civil-contingencies planning (see Topic 3.12 — Crisis, Emergency, and Resilience Management), which makes the discipline of keeping the register current a matter of national resilience, not only regulatory housekeeping.

Social sector and nonprofit

Nonprofits and non-governmental organizations sit on both sides of this topic: they are regulated bodies, subject to charity, safeguarding, and fundraising rules, and they are themselves risk-managing organizations with boards that should hold their own risk registers and risk appetite statements. Safeguarding is where the precautionary principle appears most starkly in this sector — irreversible harm to a vulnerable person justifies a very low risk appetite even amid genuine uncertainty about a specific allegation — while proportionality argues against imposing the compliance burden designed for a large institution on a small volunteer-run charity with a handful of paid staff.

Multilateral and international

International bodies mostly set standards rather than enforce them directly, relying on national governments to transpose and apply agreed rules — food-safety standards, maritime and aviation safety codes, and international environmental agreements are typical examples. The precautionary principle has an explicit home in international law, most visibly in the Rio Declaration on Environment and Development, but because enforcement depends on national implementation, risk appetite in practice still varies by member state, producing genuine fragmentation even where the underlying standard is shared.

Common failure modes

Regulatory capture. A regulator that depends on the regulated industry for information, staff, or funding gradually adopts that industry's view of acceptable risk, without any single decision that looks like corruption. The cost shows up years later, when a risk the regulator had stopped treating as urgent materializes at scale.

The zombie risk register. A register is created, populated once, and then updated only when an auditor requests it. It gives the appearance of risk management without the function: nobody is actually deciding, on a cycle, whether the listed risks and their mitigations still reflect reality.

Precautionary paralysis. The precautionary principle is invoked without a proportionality test, a stated evidential threshold, or a review date, turning a reasoned pause into an indefinite block. Genuinely beneficial innovation — a new medical technique, a cleaner industrial process, a more efficient technology — is delayed or abandoned not because the evidence of harm is strong, but because reversing a precautionary restriction always looks, politically, like relaxing vigilance.

The post-hoc impact assessment. A regulatory impact assessment is written after the political decision has already been taken, to build a paper trail rather than to inform the choice. Its options analysis reliably favours whichever option the sponsor had already chosen, which is detectable but rarely challenged.

Regulatory creep without sunset. New rules are added in response to each new problem, but old rules are rarely repealed, so the cumulative compliance burden keeps growing even as individual risks recede. Without a sunset provision or equivalent review mechanism, nobody owns the question of whether a given rule is still earning its cost.

Siloed risk management. The risk register lives with the risk or compliance function; the emergency plan lives with the resilience function; the two are rarely reconciled. The scenario a risk register has flagged as likely and severe is then absent from the exercise the emergency-planning team last rehearsed (see Topic 3.12 — Crisis, Emergency, and Resilience Management).

The unaccountable regulator. Enforcement power without a working external check — an appeals route that is never used, an oversight committee that never meets, a legislature that never scrutinizes — leaves a regulator's risk judgements untested by anyone outside the organization making them (see Topic 3.4 — Accountability, Transparency, and Legitimacy).

Maturity model

Checklist

• Draft a risk appetite statement with your governing body and publish it.
• Build or refresh a risk register with a named owner and review date for every entry.
• Classify each regulatory power by instrument type — command-and-control or risk-based — and check it matches the risk it targets.
• Run a regulatory impact assessment before adopting or renewing a significant rule, sized to the rule's scale.
• Apply a proportionality test whenever the precautionary principle is invoked, with a stated evidential basis and review date.
• Set a sunset or review date on every new regulation.
• Confirm your regulator's accountability route is independent of the industry it regulates (see Topic 3.4 — Accountability, Transparency, and Legitimacy).
• Link the top entries of your risk register to your emergency and business-continuity plans (see Topic 3.12 — Crisis, Emergency, and Resilience Management).
• Report risk appetite breaches to the board, not only to the risk or compliance team.
• Review the whole risk register at a fixed interval, not only after an incident.
• Check whether staff can name the organization's risk appetite in a sentence; if they cannot, treat the statement as unpublished in practice.

Key sources

Ian Ayres and John Braithwaite's Responsive Regulation: Transcending the Deregulation Debate (1992) remains the foundational account of the enforcement pyramid and risk-differentiated enforcement summarized in this topic's core concepts. Cass Sunstein's Laws of Fear: Beyond the Precautionary Principle (2005) is the standard critical treatment of the precautionary principle's limits, particularly its tendency to be invoked asymmetrically. ISO 31000 is the reference international standard for risk management structure; the United Kingdom's HM Treasury Orange Book adapts a similar structure specifically for government bodies. The European Environment Agency's Late Lessons from Early Warnings report collects case studies on the cost of both neglecting and misapplying precaution. The United Kingdom's Better Regulation Framework and its Legislative and Regulatory Reform Act 2006 are used in this topic as a worked, checkable example of proportionality and impact-assessment duties placed on regulators by statute and guidance; equivalent frameworks exist in many other jurisdictions.

References

1. Regulation — Wikipedia — https://en.wikipedia.org/wiki/Regulation
2. Regulatory agency — Wikipedia — https://en.wikipedia.org/wiki/Regulatory_agency
3. Regulatory capture — Wikipedia — https://en.wikipedia.org/wiki/Regulatory_capture
4. Regulatory impact analysis — Wikipedia — https://en.wikipedia.org/wiki/Regulatory_impact_analysis
5. Regulatory risk differentiation — Wikipedia — https://en.wikipedia.org/wiki/Regulatory_risk_differentiation
6. Risk management — Wikipedia — https://en.wikipedia.org/wiki/Risk_management
7. Risk appetite — Wikipedia — https://en.wikipedia.org/wiki/Risk_appetite
8. Risk register — Wikipedia — https://en.wikipedia.org/wiki/Risk_register
9. ISO 31000 — Wikipedia — https://en.wikipedia.org/wiki/ISO_31000
10. Precautionary principle — Wikipedia — https://en.wikipedia.org/wiki/Precautionary_principle
11. Proportionality (law) — Wikipedia — https://en.wikipedia.org/wiki/Proportionality_(law)
12. Sunset provision — Wikipedia — https://en.wikipedia.org/wiki/Sunset_provision
13. Better Regulation Framework — UK Government — https://www.gov.uk/government/publications/better-regulation-framework
14. Legislative and Regulatory Reform Act 2006 — UK Public General Acts, legislation.gov.uk — https://www.legislation.gov.uk/ukpga/2006/51/contents
15. Orange Book: Management of Risk – Principles and Concepts — HM Treasury — https://www.gov.uk/government/publications/orange-book
16. Late Lessons from Early Warnings: Science, Precaution, Innovation (EEA Report 1/2013) — European Environment Agency — https://www.eea.europa.eu/publications/late-lessons-2