Taking On The Powerful Few

When good regulatory risk governance creates its own risk

When it comes to the harder edge of regulatory investigations, one small group has the power to cause issues that go far beyond the boundaries of conventional risk governance. The challenge for the regulator in these exceptional cases is to keep regulatory judgement and organisational resilience separate. 

What will this investigation cost us?

What happens when you are considering an investigation into an individual or body powerful enough to change your whole risk environment? To bring long-lasting and negative media attention, influence political structures, and cost the regulator dearly in resources and reputation? 

In 2022, the UK Government legislated to impose a ban on the Electoral Commission bringing prosecutions. The Commission hadn’t used this long-standing power, but was planning to develop the capability. Oh no you don’t, said the Government, which also happened to be a political party heavily fined by the Commission. And another thing, said the Government, we’re also imposing a Strategy and Policy Statement on you.

Look also at the last few months. A money- and time-wasting by-election widely recognised as an attempt to present the investigators as public enemies. And the not-as-yet-denied allegation of private investigators looking into journalists who ask difficult questions.

When good risk governance creates its own risk

Most regulatory investigations create risk: seriousness of the breach, legal challenge, resource cost. Good governance expects the regulator to consider both resource and reputation risks, and factor these into a decision about proportionality 

However, when you know the actor you want to investigate has the power to alter your entire risk environment, it can change this assessment. Which, in some cases, is precisely what that actor wants. 

Risk governance can therefore produce an unintended result: the greater the actor’s ability to make scrutiny costly (in its widest sense), the stronger the case the regulator feels it needs before scrutinising them. 

This creates a structural asymmetry. With the same evidence base, some actors can make an investigation disproportionate while others cannot. An investigation is about establishing the facts from a position of uncertainty, so the regulator’s own good risk governance responds to the structural asymmetry by changing the point at which it will act to reduce uncertainty.

Defend thyself by all means

This is more than theoretical. A 2025 study of risk in a UK regulator found that reputation was central to regulatory culture. A strong reputation was considered necessary for influencing regulated organisations, but reputation was fragile. Consequently, protecting that reputation could lead to risk aversion and reluctance to challenge in situations where reputation was perceived to be at significant risk. 

Of course, regulatory investigations carry costs for those facing them too. Stress, time, resources and more can all result from being under investigation. We can hardly expect a powerful individual or organisation to accept regulatory action meekly. 

By all means challenge jurisdiction, procedure, evidence, fairness and proportionality. Sometimes, the regulator will be found wanting. 

But the examples given above are not of this order. They show that some actors can cause huge damage to regulators or even change their legal powers. Taking this seriously is rational risk governance. Which is precisely why the actors that have this capability present an unusual challenge. 

Supplementing rational risk governance 

The answer is not to create an entirely new risk governance framework. Instead, supplement the existing framework with a sequence of four additional considerations. 

1. Identify capability, not prominence. Don’t ask whether an actor is famous or difficult to deal with. Instead, ask whether they possess unusual capability to alter your political, reputation or resource environment.

2. Separate case risk from institutional risk. Explicitly separate the risks inherent in the alleged conduct and opening an investigation from the risks generated by the capabilities of the actor. 

3. Run the counterfactual. If the evidence and the potential breach were identical but the subject lacked the capability of the actor you are looking at, would you make the same decision?

4. Separate regulatory judgement from organisational resilience. First ask whether the uncertainty merits investigation. Then ask how the organisation will manage the consequences. The order is important: consider the merits first. 

This sequence will not eliminate the different order of risk created by unusually powerful actors, nor press you to ignore legitimate reputation and resource considerations. Their benefit is in reducing the actor’s ability to stave off scrutiny by threatening - implicitly or explicitly - long-term consequences. This removes the structural asymmetry, supporting regulation that is consistent, fair and responsive.