Implementing Risk-Based Regulation

The COVID-19 pandemic has brought to attention the importance of governments shaping effective and efficient decisions according to the emerging needs of communities with flexible, adaptive, consistent, and proportional approaches. Indeed, the role of regulation in responding to the various phases of the COVID-19 crisis became a central topic at every level of public debate for the general public, media, and decision-makers.

Risk-based approaches help regulators move from ex ante to ex post control of the regulated subjects. When scientific uncertainty is high, regulators follow a precautionary approach to regulatory delivery. As scientific knowledge improves, however, regulators can base their decisions on science and balance the risk tradeoffs that come from being either overly cautious or completely casual.

In response to COVID-19, different countries made different risk decisions as reflected in their divergent approaches to handling the pandemic. Some countries were very strict, while others put next to zero restrictions in place. Choosing minimal restrictions, however, not only contributed to the public health crisis but it also negatively impacted public perceptions about the dangers of the disease. Balancing a precautionary approach through scientific decision-making, periodic regulatory review, and international cooperation can help regulators gain trust and make transparent decisions.

Regulation is a dynamic phenomenon, as are risks. Accordingly, a systematic review of rules, resources, and the regulator’s institutional framework is always needed to ensure regulation is constantly fit for purpose. An efficient risk-based approach to regulation would build on this kind of systematic review and allow for regulatory agility, which is essential for rules to work as rule makers intended.

The Organization for Economic Cooperation and Development’s (OECD) latest Regulatory Policy Outlook reveals that, despite considerable progress in adopting risk-based tools across countries and regulatory fields in recent years, risk-based regulation is far from being uniformly and consistently applied. Methodologies are partially spread for several reasons.

First, not all countries have assimilated the concept of risk in the regulatory context. Some countries believe they are adopting risk-based instruments but misunderstand what these instruments are.

The OECD defines risk as “the combination of the likelihood of harm of any kind and the potential magnitude and severity of this harm.” An adequate risk analysis enables public bodies to devise proportionate, effective, and efficient regulatory solutions at each step of the regulatory cycle in pursuit of public goals. But some countries regulate certain hazardous matters without properly assessing the risk.

Second, significant cultural barriers stymie the use of risk-based methodologies. These difficulties could be seen in some governments’ resistance to prioritizing different levels of risk in order to protect the public interest. Instead, these governments preferred a culture of controlling “everything and everyone”—an approach which, while reassuring on paper, is often infeasible in reality.

For these reasons, the OECD recommends international regulatory cooperation for countries to work on empowering risk culture, enhancing empirical evidence, overcoming false perceptions, and enabling legislation to enjoy the benefits of innovative approaches from data and the digitization of procedures.

A common obstacle to employing risk-based approaches effectively is a lack of digital tools. Despite the rapid rate at which information technology and data storage systems have become more affordable and accessible, the use of digital tools in regulatory delivery has been slow.

Digital technology and big data can ensure efficient use of resources, which is important in regulatory delivery where both financial and human resources are often constrained. Data-based regulatory delivery, including machine learning and predictive analysis, can help plan inspections and enforcement and prioritize activities that are at higher risk for regulatory control.

Machine learning and predictive analytics need large volumes of data, but they are not always available. Data often exist only in physical form—on paper—or they are not compiled in a useful manner. Scanned versions of paper data are typically not useful because digital readers may not be able to analyze the scans easily.

Data collection and storage also need a strong legal, organizational, and technical framework. Privacy legislation, memoranda of understanding, and sharing agreements can help set the background for smoother data collection and storage while getting ahead of legal challenges. An organizational culture for collecting and sharing data in a timely manner and investing in technical upskilling is also important.

In addition to saving resources, data-based approaches to risk management can help regulators focus better on the stated goals of regulation—such as protecting the environment or public safety—rather than simply punishing non-compliance. Data-based approaches can free up resources to foster greater cooperation and trust between the regulator and economic actors, which in turn can promote a culture of safety rather than of strict compliance.

The OECD’s Recommendation for Agile Regulatory Governance to Harness Innovation also stresses the importance of adopting a risk-based framework for better agility. One area where risk-based approaches can help is in combating climate change. A global transition to clean energy is at the core of climate action, but regulatory approaches have been slow in supporting energy transitions. This delay is partly due to the fact that the technology relevant for energy transitions is complex and presents uncertainty about its safety.

Many countries have conventionally regulated everything with strict safety requirements. But in the energy sector, this approach has imposed avoidable burdens on operators investing in low-carbon energy systems such as hydrogen. In contrast, a risk-based approach to safety can ensure control of only hazardous activities. Small-scale and low-risk activities can benefit from exemptions and simplified regulatory procedures. This approach can improve investor confidence and also facilitate a faster energy transition.

Regulatory success depends on a number of factors, but risk-based regulation lies at the core of efficient regulatory delivery. Such an approach can help regulators become more agile while also managing resources efficiently. A risk-based approach to regulation can strengthen regulatory goals of safety and improve public trust. Regulatory systems need to shift their focus to strengthening risk-based frameworks that can make better use of digital technologies and enable improvements in international regulatory cooperation.

Florentin Blanc is a staff senior policy analyst at and head of the Regulatory Delivery Program at OECD.

Hamsini Shankar is an external consultant at OECD’s Regulatory Policy Division.

Francesco Calisi is a PhD student at the Libera Università degli Studi Maria Ss. Assunta of Rome and an external consultant at OECD’s Regulatory Policy Division.