Beyond compliance: the case for regulatory curiosity

Regulation requires judgement. It requires regulators to make decisions based on evidence, to understand risk and to act proportionately. But there is another quality that is perhaps less often discussed, yet fundamental to effective regulation: curiosity.

What is regulatory curiosity?

Regulatory curiosity means being prepared to look beyond the immediate appearance of a regulated person or organisation and to ask: What else do we need to know?

A regulated entity may appear to be compliant. Its policies may be in place, its processes may look sound and the information provided to the regulator may give reassurance. But appearances can sometimes (accidentally or otherwise) conceal important risks. The information presented to a regulator may be accurate but incomplete. A positive set of performance indicators may sit alongside individual cases that tell a different story. A well-designed policy may not be consistently applied in practice.

A curious regulator (or oversight body) does not simply accept the first answer. It asks sensible follow-up questions. It tests whether what is said is reflected in what actually happens. It looks for patterns, inconsistencies and unexplained anomalies. It draws on intelligence from different sources and seeks to understand the context behind the information it receives. This is not about assuming that regulated people or organisations are failing to comply. Nor is it about creating a culture of suspicion. It is about recognising that effective public protection requires sufficient assurance, not simply sufficient information.

Balancing curiosity with proportionate regulation

But there is an equally important danger at the other end of the spectrum. Curiosity must not become an excuse for regulators (or oversight bodies) to check everything, demand every conceivable piece of evidence or impose ever more burdensome requirements on those they regulate. That would not be effective regulation/oversight.

The challenge, therefore, is to find the right balance. And the right-touch regulation approach provides a useful way of thinking about that balance.

A risk-based approach to regulatory curiosity

The level of regulatory curiosity should be proportionate to the risk of harm. Where the potential harm is low, the evidence is strong and the regulatory history is reassuring, limited assurance may be entirely appropriate. Where there are significant potential harms, weak controls, unexplained inconsistencies or emerging warning signs, the regulator should be prepared to dig deeper. This means that curiosity itself should be risk-based.

The regulator should ask not simply “What information have we been given?” but “What assurance do we need, given the risks?” Sometimes the answer will be straightforward. Sometimes it will require triangulating information, speaking to others, examining outcomes rather than processes, or testing whether policies work in practice.

Perhaps most importantly, regulatory curiosity should be accompanied by professional humility. Regulators can be wrong. They can be reassured too easily, but they can also overreact to isolated concerns. Curiosity should therefore lead to better questions and better evidence, not predetermined conclusions.

Knowing when to look deeper

Ultimately, regulatory curiosity is about maintaining an appropriate degree of healthy scepticism while retaining trust in those being regulated. The goal is neither to accept everything at face value nor to scrutinise everything to the nth degree. It is to know when to ask “Is there more here that we need to understand?” – and to have the judgement to know when we have understood enough.

That is regulatory curiosity. And, when applied proportionately, it is an important part of effective public protection.