Keywords

The relationship between regulators and those they regulate is fundamentally constitutive of the regulatory endeavour. By making and enforcing of rules, and undertaking other related efforts, regulators seek to shape the behaviour of the managers and employees within regulated organisations so as ultimately to reduce risks and solve other regulatory problems.

At the base of the regulator–regulatee relationship lies the rules themselves. Regulators interact with regulatees, after all, by seeking “to constrain their behaviour by rules” (Rasmussen 1997). And just as engineers widely recognise that the design of equipment and technology can affect the safety of complex industrial systems, the design of rules affects safety too. The way rules are written—their design and content—establishes the foundation for the regulator–regulatee relationship by defining the regulator’s expectations for the regulatee and by shaping the demands placed on the regulator for information and oversight.

Regulators have unfortunately long lacked a clear and common taxonomy of rule design. This is not to say that rule design—or what is sometimes called regulatory instrument choice—has been overlooked. On the contrary, a substantial body of important research offers insights on different regulatory designs (Richards and van Zeben 2020). Existing research, though, has “more diversity than uniformity” in how varied rule designs are conceptualised and labelled (Richards 2000). The lack of a commonly accepted conceptual framework has impeded progress in both regulatory science and practical decision-making by regulators. This chapter presents a unifying framework on rule design that can offer clarity for both researchers and safety regulators alike.

10.1 Rules and the Regulator–Regulatee Relationship

At its core, the regulatory enterprise is relational. Regulators seek to influence the behaviour of those they regulate—and often these regulatees seek to shape the behaviour of regulators too. Ultimately, regulatees’ behaviour determines the success of the regulator, as the latter’s performance depends irreducibly on the actions within regulated organisations (Coglianese 2017a). For safety regulation to improve, the rules underlying the relationships between regulators and those they regulate must also improve.

Admittedly, the regulatory–regulatee relationship is only one part of a larger set of interconnected relationships that make up the overall “socio-technical system” managing risk in society (Rasmussen 1997). Clearly “[m]any levels of politicians, managers, safety officers, and work planners are involved in the control of safety by means of laws, rules, and instructions that are formalised means for the ultimate control of some hazardous, physical process” (Rasmussen 1997). Risk management depends on the behaviour of different actors operating at different institutional levels, with “threats to safety or accidents … usually caused by multiple contributing factors—relationships” (Vincente 2003).

Among these relationships, the ones between regulators and regulatees have an important role to play in risk management in the face of dysfunctional relationships operating in the economic marketplace—principally, those between buyers, sellers, investors, and employees. When market relations fail to deliver an optimal level of risk control, legislators and regulators adopt rules and establish the basic terms of the regulator–regulatee relationship.

Rules can be stringent and demand much of regulated firms. Or they can be lax and require little behavioural change. They can be specified with precision or articulated in terms of broader principles (Black 2008). They can be designed to give regulated firms more or less flexibility—and correspondingly to give more or less discretion to the regulator (Coglianese and Bennear 2012).

By making choices about the stringency and design of a rule, a regulator seeks to find the most optimal way to shape industry behaviour and ultimately achieve risk control objectives. The precise design of a rule will depend on the problem the regulator seeks to solve as well as the capabilities of the regulator and the incentives of the regulatees. And no single design will apply in all circumstances, for all problems, or for all time. Although rules are by nature intended to be static generalisations (Schauer and Zeckhauser 2007), they can be modified as circumstances change. In addition, waivers and exemptions can be granted when appropriate (Coglianese et al. 2021).

10.2 A Framework for Rule Design

Rule designs have been described using many labels: command-and-control regulation, prescriptive rules, design and performance standards, management-based regulation, market-based instruments, defaults and nudges, information disclosure, and more (Richards 2000). The varied nomenclature used to describe rule designs can be simplified into four categories based on two dimensions of rule design: means versus ends, and micro versus macro (Coglianese 2010; National Academy of Sciences 2018).

Means-based rules require regulated firms to take or avoid actions, while ends-based rules mandate that they achieve or avoid certain outputs or outcomes (Coglianese 2010). Macro versus micro rules differ in terms of where they focus attention on a causal chain leading to risk and other problems. Micro rules are focused on a “specific contributor or causal pathway to the ultimate problem,” but macro rules place the regulatee’s attention on the “ultimate problem itself” (National Academy of Sciences 2018). This framework is shown in Table 10.1.

Table 10.1 Rule designs
Full size table

Human factors researchers may see in this framework some similarities with task analysis and work domain analysis. Task analysis contains a similar means-end distinction, with a firm’s managers instructing employees on either the “goals they should be trying to achieve or how they should be achieving them” (Vincente 2000). With task analysis, managers give their employees (i) detailed instructions akin to a micro-means rule, or, like a micro-ends rule, (ii) instead simply spell out a constraint or outcome, leaving it to employees to figure out how to attain or avoid that outcome (Vincente 2000).

Work domain analysis essentially presents workers with a system’s structure so they can figure out their own actions to take. It has been said that, with work domain analysis, “we have to do the thinking ourselves to derive a particular set of actions … from where we are to where we want to be” (Vincente 2000). In this respect, work domain analysis bears certain affinities with macro-means rules, which have sometimes been viewed as tools for “making bureaucracies think” (Taylor 1984).

Two dimensions in work domain analysis—ends-means, and whole-part—bear affinities with the two dimensions in the rule design framework presented in Table 10.1 (Rasmussen et al. 1994). The means-end dimension used here, though, includes both actions and structures, whereas work domain analysis focuses on structures (with actions addressed by task analysis) (Vincente 1999). The macro-micro dimension here is similar to but not identical to the whole-part dimension in work domain analysis, as the framework used here simply distinguishes between the endpoint on an event tree (macro) versus a node or pathway leading up to that endpoint (micro) (National Academy of Sciences 2018).

10.3 Rule Designs: Advantages and Disadvantages

Although the performance of any rule design will depend on the regulatory context, some generalisations about the relative advantages and disadvantages of each type can be suggested. Many of these advantages and disadvantages mirror those associated with instructions-based and constraints-based task analysis (Vincente 2000). The flexibility afforded by the two types of macro-based results in affinities with the qualities of work domain analysis (Rasmussen et al. 1994).

Micro-means rules. When a regulatory problem or risk is shared and relatively stable across regulated entities, a regulator may choose to specify the exact behaviours or actions that regulatees must take—that is, use a prescriptive or micro-means rule design. This design leaves little flexibility for regulatees. It can be justified when problems are understood and when a one-size-fits-all strategy will truly fit all (or most) firms. This is similar to the observation specifying concrete risk management actions will be “useful when behaviour is very tightly controlled by the control requirements of a technical system” (Rasmussen 1997).

The specificity of a micro-means design should also make compliance with the rules more readily verifiable and the regulator’s role easier—but it may also potentially contribute to the disadvantage of creating a narrow “box-checking” mindset by the regulator (Bardach and Kagan 2002). Another disadvantage is micro-means rules’ lack of cost-effectiveness in the face of heterogeneity among regulated entities. In some firms, the mandated means may not even be effective in controlling risk. Obligating firms to adopt a particular means may also discourage them from searching for more effective or less costly solutions (Goulder and Parry 2008).

Micro-ends rules. In contrast, micro-ends rules give regulated entities flexibility in their choice of risk control actions. These rules—also referred to as performance-based regulation—require regulatees to achieve or avoid specified outputs along the causal path leading towards a hazard or other problem (Coglianese 2017b). An emissions limit on air pollution from an industrial facility is an example because it does not mandate any means by which the facility must meet its mandated limitation.

Such output limitations for micro-ends rules can be the same for all regulated entities or they can sometimes vary from firm to firm in a market-based regulatory system. Under emissions trading systems, for example, different firms adhere to different pollution limits based on the number of permits each firm has obtained through market transactions (Newell and Stavins 2003).

Micro-ends rules allow for innovation and adjustment to varying circumstances. This flexibility, though, makes it imperative that the regulator can monitor compliance. Otherwise, regulated firms may exploit the rule’s flexibility by simply satisfying a required output to the letter but by finding ways that evade the rule’s overall spirit or create other untoward consequences (Coglianese 2017b).

Macro-means rules. An increasingly popular rule design in the context of regulating high-hazard industries seeks to steer firms’ managers in the direction of improved risk control. For this reason, macro-means rules are sometimes referred to as management-based regulation (Coglianese and Lazer 2003).

This rule design is macro in orientation because it directs managers’ attention to the ultimate risk problem. It mandates “internal planning and management practices” to compel managers to analyse the pathways that lead to risks within their operational settings and to identify and implement their own risk control solutions (Coglianese 2008). Internal analyses and plans must comply with criteria determined by the rule. Several examples illustrate:

  • Food safety regulations around the world require food processors to implement hazards analysis and critical control point (HACCP) management systems, through which firms must assess food safety risks in their operations and develop plans to reduce them (Coglianese and Lazer 2003).

  • The US Environmental Protection Agency and Occupational Safety and Health Administration impose separate but similar management-based requirements on large chemical facilities (Coglianese and Lazer 2003). These rules call for firms to conduct their own hazard analysis, identify risk reduction interventions, develop operating and emergency procedures, and conduct internal auditing.

  • The US Department of Interior’s Bureau of Safety and Environmental Enforcement requires offshore drilling operations to establish safety and environmental management systems (SEMS). Drilling operators must develop and conduct their own hazard analysis and safety planning (Coglianese and Starobin 2020).

  • Regulators at the US Department of Homeland Security rely on macro-means rules to encourage large chemical facilities to address terrorism risks. Facilities must prepare “vulnerability assessments” and then develop plans and procedures to address those vulnerabilities (Coglianese and Starobin 2020).

Macro-means rules like these examples are generally thought to be appropriate whenever one-size-fits-all solutions do not exist and when outputs are difficult to measure (Coglianese and Lazer 2003).

Macro-means rules place responsibility for risk analysis and control in the hands of private sector managers who have more complete information than government officials (Braithwaite 1982; Hutter 2001), ensuring that the truly “detailed rule-making takes place at a level where the context is known” (Rasmussen 1997). This has important implications for the nature of the regulator–regulatee relationship because it essentially places the regulator in a “meta-regulatory” role of overseeing regulatees’ own internal rulemaking (Coglianese and Mendelson 2010).

Of course, smaller firms often lack the capacity for the internal analysis and planning required of macro-means rules. In addition, macro-means rules may merely elicit “pencil-whipping” or “window dressing” behaviour—that is, efforts simply to go through the motions in engaging in risk management activities without taking these required planning and other management steps seriously (National Academy of Sciences 2018; Gray and Silbey 2014). To help ensure that firms take macro-means rules seriously, regulators need a workforce with skills to assess meaningful analysis and motivate robust planning by regulated firms (Vincente 2000).

Macro-ends rules. A final rule design is sometimes referred to as a “general duty clause” or, simply, liability for harm (Baram 1996). Macro-ends rules impose the obligation for the regulatee to avoid accidents or catastrophes—with firms paying a penalty if these hazards occur. These rules contain no requirements targeting any specific pathway to ultimate risk. Instead, the threat of penalties and liability after an incident occurs provides incentives for the regulatee to take preventive action. Although macro-ends rules are often part of a regulator’s arsenal, typically this design operates as a backstop to rules of other designs.

10.4 Implications for the Regulator–Regulatee Relationship

The range of rules falling within these four main designs make up what can be thought of as the regulator’s toolkit (Hood 1983). The challenge for regulators lies in “choosing the right regulatory tool and understanding which one to use when and with whom” (Hutton 2015). In this respect, not only does a rule’s design set the terms of a regulator’s relationship with regulated firms but the choice of that design will itself be relational.

The advantages and disadvantages of rule designs discussed in this chapter are relative and general ones. Their success will depend on the specific context within which they are applied. The nature of the regulatory problem will partly affect that success. Micro rules, for example, can work better for simple, well-understood problems than for complex and uncertain ones.

Sound rule design depends on more than just fitting a design to a risk or other problem; it also depends on fitting the design to the regulators and regulatees. Some regulatees—often because of their size—may need to be told exactly what to do. Others may have the capacity or well-earned trust to act responsibly under more flexible rules. Furthermore, regulators themselves will need to possess different capabilities for monitoring and enforcing rules depending on their design.

In tackling any given problem, regulators may wish to combine rules of different designs to address different facets of a problem or better manage the relationships with different types of regulatees. Combinations can occur when different rules target different causal pathways to a risk using different designs. They may also be appropriate for regulated sectors with highly varied regulatees, as more flexible designs could be available for larger firms that possess effective internal risk management capacities, while more prescriptive designs can be used to offer guidance to smaller firms that may need more direction. When combining rules—whether of the same or different designs—regulators obviously need to ensure that different rules avoid working at cross-purposes and that they do not simply accumulate costs without delivering corresponding benefits.

10.5 Conclusion

Ultimately, regulators must exercise careful judgement in making choices about rule design. These choices can be informed by risk assessment and benefit-cost analysis prior to adopting a new rule (OECD 2020). They can also benefit from research on how different rule designs fare after they are adopted (Bennear and Wiener 2019). Future research can be facilitated by a clear, common framework of rule design, which is the reason for presenting the typology offered in this chapter.

Regulators also need to remain vigilant. They must continuously monitor how their rules’ designs are working in practice. They need ongoing engagement with and attentiveness to their regulatees—that is, effective relationships. After all, although safety outcomes can be affected in important ways by the content and design of rules, they are also affected by other aspects of the ongoing, dynamic relationships that make up the regulatory endeavour.