Keywords

1.1 The Advent of Safety-Critical Systems

What can we say about the regulator–regulatee relationship in the context of safety-critical systems in the 2020s? The concept of ‘safety-critical systems’ remains a recent analytical category from a research point of view. It is thirty to forty years old. Perrow (1984) played an important role in this new interest by scholars for these systems when he published his iconic book ‘Normal Accidents’. The book had a subtitle ‘Living with high-risk technologies’ (Perrow 1984). Its genesis was directly connected to Three Mile Island in 1979, the accident of the nuclear power plant in Harrisburg, USA. This event triggered several lines of investigation by the social sciences (Sills et al. 1982), including by scholars of public administration and public policy who studied the conditions for fruitful relationships between private companies and authorities (regulator–regulatee) in the aftermath of this event, based on self-regulatory schemes (Rees 1994; Gunningham and Rees 1997). The concepts of ‘high-risk systems’ or ‘safety-critical systems’ were thus born in the 1980s. They existed for a longer period, but their increasing presence was strongly felt in societies, challenging our sense of remaining in control in a technologically shaped world. This new notion discriminated a diversity of organisations which shared their potential for acute negative externalities (e.g., explosions, radiation, toxicity, crash, derailment, and spill). Nuclear weapons, chemical plants, aircraft, mines, railways, air traffic control, space, and maritime were some of the most visible cases of systems to be contrasted with other kind of organisations (e.g., universities, manufactures).

Of course, the nuclear disaster of Chernobyl in 1986 or Piper Alpha in 1988 (the explosion of an offshore platform in the North Sea), not to mention other major events of that period in other industries (e.g., Bhopal, Challenger, Herald of Free Enterprise), reinforced the importance of this topic. New concepts were introduced, developed, and debated as part of this trend. The 1980s and 1990s were fruitful years in this respect with important concepts such as human error (Reason 1990; Rasmussen 1990; Woods et al. 1994), safety culture (Turner and Pidgeon 1997, Reason 1997), and high-reliability organisation (Roberts 1993; Weick et al. 1999), addressing several core topics of a multifaceted problem: understanding, managing, and regulating such systems. The role of states, of civil society, of agencies, and of inspections have also been at the heart of this endeavour for several decades, along with these other important concepts. The introduction of the idea of enforced self-regulation (Ayres and Braithwaite 1992) with mining—a typical safety-critical system—as one of the original case studies (Braithwaite 1985) is an illustration. It was a critique and an alternative to the prescriptive style, also described as command-and-control, of regulating. Another is the concept of risk regulation regime (Hood et al. 1999) with Beck’s thesis on the ‘risk society’ in the background, translated from German to English in the early 1990s (Beck 1992).

This interest in safety-critical systems has only kept growing over the years, reflecting the diversity of existing research traditions (e.g., engineering, sociology, cognitive engineering, psychology, public administration, and management), and the need for adapted research strategies to explore their inner working considering their multidimensional facets (Le Coze 2019; Pettersen-Gould and Macrae 2021). One important thread across the traditions is the realisation that their operating landscapes have profoundly changed, reformulating our analytical lenses inherited from the 1980s. Changes over the past forty years have indeed reconfigured the operating landscape of safety-critical systems across countries, across continents and require us to revisit our mindset, including Perrow’s seminal contribution (Le Coze 2020). These major shifts are easily identified retrospectively. In the 1980s, Internet was in its infancy, financial capitalism was only taking off, the ecological crisis was slowly materialising, and globalisation (as an increase of flows across nations and continents) was building up. In the 2020s, these trends are now in full force, along with geopolitical shifts. With these changes in mind, Fukushima Daïchi (2011) or Deepwater Horizon (2010), mirroring the Chernobyl and Piper Alpha accidents of the 1980s, are interesting events of the early twenty-first century for safety-critical systems and for the regulator–regulatee relationship. Fukushima is an example of a vulnerable high-risk system in its natural environment combined with a critical lack of independence between the Japanese state and private interests, what is known as the risk of ‘regulatory capture’ (Carpenter et al. 2014). It questions, in a context of ecological crisis, the ability of societies to protect critical infrastructures such as nuclear power plants from the effects of the Anthropocene, and the role of states and regulations in this developing picture. The explosion of the offshore platform Deepwater Horizon represents the failure of the financialised multinational, BP, embracing globalisation and operating as a network organisation across the world, but insufficiently regulated, at least in the USA (Bergin 2011). It challenges the ability of states to deal with powerful multinationals operating across the world.

1.2 Regulating in Evolving Contexts

In public administration, public policy, and regulatory studies, the move from state-centric to polycentric contexts (as exemplified by the BP case, Mills and Koliba 2015) has been described as an essential trend associated with the increasingly globalised world at the turn of the century. The concept of governance captured this change by addressing the move from verticality (hierarchy) to horizontality (heterarchy), by addressing a shift towards networks, towards decentred, hybrid, or post-regulatory states with their consequences for administrations and regulations (Black 2001; Kettl 2002). A mix of new public management initiatives (Hood 1991), shaped by ‘less state’ neoliberal ideologies and privatisation, combined with deregulation of markets (e.g., aviation, energy, telecoms) and a push by multinationals pressing states to relieve them from the burdens of stringent regulations in the harsh competition of global capitalism, is one explanation. It came with fuzzy boundaries (Kettl 2002), namely with states and administrations cooperating with private or non-governmental entities, with standardisation gaining ground to translate the role of such entities through ‘soft law’ (e.g., process safety management systems), with ‘safety cases’ to be produced by companies as part of self-regulatory schemes or of audits, certification, and accreditation to ensure standard compliance (Power 1997). In the critical version of this trend, states are no longer able to play a strong role in curbing the negative externalities of private interests, at the expense of societies (Grabosky 2013; Perrow 2015).

A distinct explanation of the evolution of the regulatory governance context is the practical approach for states to move away from the command-and-control style of regulating. The command-and-control approach with its prescriptive perspective on regulation was criticised for failing to keep up with the diversity of situations and changes in technology. It also failed to harness the intrinsic motivation for compliance work of regulated entities, but additionally exposed the state to liability issues because of its commitment to define the rules precisely. The cost and burden of using prescriptive rules led to the development, experimentation, and promotion of alternative pragmatic options. Exploring the potentialities of self-regulatory philosophies, ideas such as principles-based regulation, responsive or smart regulations, outcome versus management-based regulation, meta-regulation, or risk-based regulation concretely translated this pragmatic approach. While Fukushima Daïchi or Deepwater Horizon provided opportunities to reflect on problems associated with such new regulatory instruments in the context of safety-critical systems (Downer 2013; Mills and Koliba 2015), the financial crisis of 2008 was also an important event for exploring the value, relevance but also drawbacks and limits of such new regulatory strategies (Black 2010; Baldwin and Black 2010). Indeed, if the practical approach to reform regulations was a proposition to replace the failure of command-and-control style, how and why did this practical move equally fail to prevent major events such as the financial crisis or Deepwater Horizon? This has led authors to diagnose a crisis of confidence in institutions (Coglianese 2012).

A third, alternative and complementary proposition, more descriptive than critical or practical, is to understand the evolution of regulations as a dynamic between problem formulation by societies and states’ responses (Ansell and Baur 2018). In this interpretation, risk regulation regimes depend on the way risks are framed or constructed and strategies of control deployed in relation to them (Hood et al. 2001). Major events and their analysis often play an important role because they open window of opportunity in shaping policies (Birkland and Warnement 2017). In this respect, the argument of the authors is that many threats associated with our contemporary era (many of which come from safety-critical systems), have expanded in scope and scale. Along with a shift from a reductionist to a systemic view of risks, the changes in the way regulatory governance operates through evolving strategies (e.g., self-regulation, meta-regulation, risk-based regulation) reflect the changing nature of threats, the evolving characteristics of risks.

One illustration is food safety. Considering that food is increasingly produced and circulating across continents through expanding global capitalism, it necessitates proper instruments to regulate its scope and scale. For these authors, instruments such as audits, certification, and HACCP are regulatory tools to cope with a change of risk profile which comes with increased globalisation which represents the increased connections between continents and the networks made of many different organisations. Another side of this approach by the authors is the recognition that many problems cannot be reduced to a simplistic model, such as when disasters are considered only as technical failures or triggered by front-line human errors. Disasters are systemic events (as mentioned in the first paragraph with notions such as safety culture, high-reliability organisations) and must include organisational, strategic, and regulatory failures, going beyond simplistic narratives (Hopkins 2022). The trends affecting regulation over the past decades are therefore the translation of the changing nature of risks.

1.3 An Illustration: The Regulation of Hazardous Plants in France

One example of an evolving regulatory landscape of safety-critical systems over several decades is the regulation of major accident hazards in France. It evolved from a very prescriptive approach (such as checking the thickness of vessels, which is still in use) to become more fundamentally based on the principle of risk analysis and assessment. Risk analysis is regulated through the production of a ‘safety case’ for an industrial site with hazardous processes. A safety case is a document which shows how a company handles, reduces, and prevents its process risks to attain a certain level of safety. Hazardous processes are distinguished in the headings of a nomenclature which sets the expected requirements and associated administrative processes depending on the type of industrial facility, kind of products, and quantities. These safety cases are very often produced by external experts, by consulting firms. Most companies subcontract this activity even if some of them have internal expertise to deliver these safety cases. They must send the safety case to inspectors of control authorities (working on behalf of the prefect) which scrutinise it. These reports are analysed, discussed, and criticised by inspectors. Inspectors work at the regional level, within what is described as territorial unit of the local administration.

Inspectors have the possibility of requiring a third-party review, i.e., an additional critical analysis by another expert (often a consulting company) regarding the content and quality of the safety case, if necessary. The operating company selects and contracts out this third-party expertise. Ineris (the national institute for the industrial environment and risks), in this context, plays a role at the interface between research, support for public authorities and services to companies on technological risk issues. It can also play this role of third-party expert. This technical and scientific expertise produced by Ineris supports the administration and produces knowledge in various fields (e.g., explosion, fire, resistance of structures, human factors) and provides strong inputs to the training of inspectors as well as the production of regulations, in national and European contexts (including the so-called Seveso directives since 1982). This regulatory activity is managed at the state level by the General Directorate for Risk Prevention (DGPR) within the Ministry of Ecological Transition, which now also hosts the accident investigation board for the process industries (created following a large fire at Lubrizol and Normandie Logistique in 2019, in the city of Rouen).

The regulatory process for producing a safety case also includes a territorial dimension with entities that punctuate its validation, in which representatives of local authorities as well as civil society sit. There are also structured consultation approaches for organising the relationship between private companies and civil society in the vicinities of sites, such as local information and monitoring committees (CLIS), particularly in the context of the implementation of technological risk prevention plans (PPRT), required by the Bachelot law of 2003, drafted following the Toulouse accident in 2001. These various bodies and councils constitute strong dimensions of the regulation of technological risks in relation to their territorial anchoring and to civil society, to which the themes of acceptability and risk perception are often associated.

It is also at this level that the fire and rescue services (SDIS), at the intersection of civil society, local authorities, the state, and businesses, prepare and intervene in emergency situations. Civil society is also of course represented at the national level by the activity of the parliament and the government which decides on regulatory changes as well as the orientations and budgetary resources for the activity of the central (DGPR) and regional administrations (DREAL), as well as Ineris and the regional governments, in their decentralised prerogatives. Safety cases also serve as a framework to produce prefectural orders that the inspectors of classified installations use to inspect the compliance of companies with these regulatory requirements. They thus visit the facilities according to a frequency that is defined according to the level of risks, but also according to priorities given each year by the central administration. These orientations depend on current events (for instance, “fire in warehouses”) and the issues that they raise. It is also at the level of the central administration that the evolutions of the nomenclature are decided, in interactions between companies, the expertise of the state (Ineris), and the professional associations.

It is also at this level of activity that professional guides are produced and serve as a benchmark for the development of safety cases according to industrial sectors. These guides make it possible to better frame the exercise to allow strong benchmarks and harmonisation of approaches within a profession (e.g., in oil and gas, chemicals, warehouses, or agro-business). It should also be noted that insurers play a role through their fire risk prevention activity with companies. This principle of harmonisation is also at the heart of the important activity of standardisation, certification, and accreditation in the field of risks. This facet of prevention in industry and regulation has been playing an increasing role for many years. The standards, established by consortia bringing together states, private companies, and experts at the French (AFNOR), European (CE), and global (ISO or IEC) levels are at the origin of an important source of framing practices as well as achieving reliability and safety of industrial installations. The certification of technology suppliers (including the role of COFRAC as accreditor of certifying bodies) used for the prevention of accident scenarios identified by the safety cases thus makes it possible to guide and reinforce companies in their choice (e.g., for equipment in a flammable zone which must not produce static electricity, for the reliability of a sensor in its action of detecting a gas). These certifications can also be voluntary (equipment reliability) or regulatory (ATEX for example). Ineris plays a certification role on several risk management topics.

In the area of process safety, the operating standards have thus provided principles which have been used to define the expectations and content of the safety cases, in relation to the calculations of probabilities, levels of confidence in the measures of control of the risks following regulatory changes to PPRTs. Standardisation is therefore not always associated with certification and can serve as an international reference. This non-state normative production has thus been the subject of intense expertise, advice, and audit activity for many years. It is combined with legal normativity, as with the example of safety management system standards which are the subject of private audits for certification (ISO 18000), which are close to regulatory requirements for safety management systems, which are also subject to inspection. This requirement expands the technical view of safety risks to an organisational one. Multinational companies, in their activities of supervision and centralisation of multiple entities or subsidiaries, grouped within headquarters (or corporate), also have recourse to this standardisation work for their industrial sites, which they also apply to their contractors.

As this brief description of the French regulatory framework for the process industries shows, regulation and the regulator–regulatee relationships have evolved to become a hybrid, decentred, polycentric, and network reality which combines a great number of actors shaping the operating landscape of safety-critical systems across the world. The transformations of the past decades have been shaped by the trends introduced in the previous sections. Despite relying on a state which plays a strong role, it exhibits some of these polycentric dimensions of regulations with the presence of European levels of policymaking but also regional levels of translation of policies. It shows the regulatory tools of risk-based regulation (i.e., safety case) performed by consultants, of meta or management-based principles (i.e., safety management system) which are combined in France, and not exclusive. It also illustrates the importance of standardisation, certification, and accreditation (i.e., equipment, management standards) which connect the national regulations to multinational corporate influences and international organisations (CE, ISO). It also illustrates the public presence in the regulatory process which has increased following a major event in France in 2001 (Toulouse) and the introduction of an investigation board following another more recent event (Lubrizol 2019), while introducing other actors such as insurers. The complexity of the regulatory governance of hazardous installations in France illustrates what has been described so far in this introduction.

1.4 The Chapters of This Book

With this background, each author of this book provides a unique and specific angle of analysis regarding this complex, new operating landscape and regulatory governance of safety-critical systems, starting with an overview of the work at the Center for Analysis of Risk and Regulation at the London School of Economics (LSE) over several decades. In the first chapter, Lodge and Hood look back on thirty years of intellectual development and argue that the question of limiting ‘regulatory capture’, which triggered their research agenda, remains as central as ever.… However, the contemporary context provides new problems to this regulatory problem. They write “LSE’s debates of thirty years ago mainly concerned UK and US national regulation (…) with much less attention paid to transboundary coordination in the handling of the risk issues and of national regulatory decisions than applied today”.

One feature of this new context is the increasingly polycentric dimension of regulation, something that Black describes in her chapter based on the financial industry, distinguishing the range of third parties involved, introducing them with the help of five categories (1) auditors, assurers, accreditors, certifiers; (2) knowledge and compliance intermediaries; (3) gatekeepers; (4) measurers and modellers; and (5) market-based standards setters (supply chain/production networks). She warns that “it is critical that regulators identify where there are dependencies on third parties; whose third parties are; the nature and extent of the dependencies; and the risk associated with them”.

This complexity of the financial sector and this polycentric view of the problem are also described in the medical sector in Brathwaite’s contribution, with another emphasis. Seeing the healthcare regulatory ecosystem as a complex adaptive system (CAS), Braithwaite describes the multilayered diversity of regulations which frame the context of medical professionals, patients, and regulators. Considering this complexity, he calls for a new paradigm based on a more realistic contribution of people to safe practices. He explains that “top-down forms of regulation are not the full picture (…) healthcare do not merely respond to regulation, but also self-regulate”, and he adds “It may not seem obvious to say so, but so do patients”.

In a different context of safety-critical system, the oil and gas industry, two chapters, one by Lindøe and the other by Forseth discuss one specific case of polycentric regulatory systems, the tripartite regime of Norway. In this regime, unions play a strong role between the state and industry in an enforced self-regulation scheme, with changes over time, described as a learning process. Lindøe explains that “an asymmetrical power relation and legally binding rules will lead to ‘command-and-control’ behaviours. If the regulator shifts towards the role of pedagogue in guiding the industry in implementing ‘legal standards’ embedded in laws and regulations, the power relations become more symmetrical”.

At the heart of this tripartite regime based on a philosophy of enforced self-regulation and leading to a more symmetric approach described by Lindøe, one finds indeed what Forseth describes as a dialogue. She shows that the dialogue, a continuous conversation maintained between the actors in the tripartite “regulatory space”, is the favoured strategy of the regulator in Norway, as opposed to the command-and-control style. She makes it clear, though, that there are conditions required for this to happen. “The dialogue is formalised, restricted and ritualised and the regulator and the regulatee have their particular roles to play”. Forseth’s analysis is one which conveys the importance of thinking social relationships when it comes to the regulator–regulatee relationships, a topic which is developed by Pautz.

To pay attention to social interactions in the context of regulation, such as a dialogue, is also to give credit to the active role played by both the regulator and the regulatee in the concrete, pragmatic, and contextualised translation of regulations at the front-line. Regulation appears, in this light, very much as the social fabric that it is when seen from these micro-levels of description. Pautz is very clear about the importance of thinking about regulations from this angle, indeed “all too often, the regulatory actors, whose actions constitute the implementation of regulation are overlooked”. One could add that our view of regulation is distorted when such descriptions are missing, when they are not available. This goes for the trend which accompanied the move towards polycentric, global, and multilayered governance: standardisation.

Thus, one powerful trend which was part of the research agenda of the LSE in the 1990s as introduced by Lodge and Hood in their chapter is the ‘audit society’ thesis by Power (1997). Both Galland and Størkersen provide insights into the mechanisms and consequences of this trend from a regulatory point of view. With a different meaning than the tripartite regime in Norway described by Lindøe and Forseth in their chapters, Galland introduces the tripartite standardisation regime (TSR) based on standardisation, certification, and accreditation developed for consumer safety in Europe in the 1990s. Its logic is one of the production of standards, standards which are certified by auditors while auditors are accredited to provide these certifications. This is one typical mode of operating by the third parties identified by Black, and Galland is equally cautious. “Although these risk regulation regimes seem, at first glance, globally successful and fit for purpose, they are opaque in their day-to-day functioning, are transformed or grow outdated without anyone noticing, and may sometimes lead to completely unexpected failure”.

One such problem is what Størkersen’s chapter precisely addresses: auditism. By relying on safety management systems which have become standards in the industry in the context of new regulatory regimes, the risk of decoupling between these standards, professionals’ practices and auditors’ scrutiny and certification is real. The extreme case is when “the core tasks go on outside the managed part of the organisation, undocumented and often despite the safety management system. This creates a gap between formal rules and informal practices, which may be overlooked in audits”. This reintroduces the importance of rules and their relationship with reality, and the centrality of this issue.

Coglianese exposes in this respect the different options for regulators when it comes to rules and their relevance in high-hazard contexts. His chapter is an invitation to think about rule design, crossing the micro- and macro-categories with a decomposition of means-based or ends-based rules. Four options in rule design are discussed, micro-means rules (prescriptive); micro-ends rules (performance-based rules); macro-means rules (management-based regulation); and macro-ends rules (general duty clauses). He concludes with a statement for the regulators who “also need to remain vigilant. They must continuously monitor how their rules’ designs are working in practice. They need ongoing engagement with and attentiveness to their regulatees—that is, effective relationships”.

In his chapter, Bernard provides an example in the nuclear industry of a relationship between the regulator and regulatee mediated through a regulatory assessment tool, safety culture. Bernard sees the use of this tool as an example of a practice supporting the development of responsive regulation and fostering cooperation and trust. In his own words, “at the core of the relationship between the regulator and the regulatee, the results of the safety culture assessment aid indeed at stimulating self-regulation and encouraging a regulated entity to a proactive reflection about its performance”.

One wonders, in the context of global warming, about such regulatory tools to be developed. Julien Etienne argues that global warming is the end of the world as we knew it and that it comes with radical consequences for risk regulatory regimes. Many of the safety-critical systems covered by such regulations are involved in what is described as a “double materiality”. They are both exposed to the effects of global warming (droughts, heatwaves, extreme events such as storms, floods, or rising sea levels) and producers of global warming through their carbon emissions. In this pressing context, Julien asserts that “business as usual is a self-defeating strategy, whether one thinks of regulation as a solution to market failure, a way of making hazardous industries acceptable, or a way of ensuring the safe operation of industries that deliver core services and products to society”.

Overall, from the description of regulatory governance configurations in polycentric contexts to the analysis of the active processes of translation at the front-line through social interactions, the chapters of this book cover a range of perspectives which shed light on the regulator–regulatee relationships. The new local and global challenges to come, from regulating digital societies which include issues of cybersecurity and artificial intelligence to building responses to global warming, ecosystems’ collapse, and pollution’s effects on health will require inventive modes of regulating safety-critical systems in future...