page_title: Regulatory risk differentiation
section_title: Risk matrix mapping – risk differentiation framework
hierarchical_section_title: Regulatory risk differentiation / Risk matrix mapping – risk differentiation framework
caption_attribution_description: English: Risk Matrix showing a pareto distribution of risk - many lower likelihood/lower consequence and few higher likelihood/consequence
context_page_description: Regulatory risk differentiation is the process used by a regulatory authority to systemically treat entities differently based on the regulator's assessment of the risks of the entity's non-compliance.
  Regulators can include law enforcement agencies. Entities refers to those under the authority/control of the regulator – in most cases ranging from individuals to companies to legal entities to multinationals operating within the regulator's jurisdiction.
  The process requires the regulator to directly link a robust risk assessment to a suggested regulatory response. Regulatory risk differentiation is also referred to as the Compliance Model in some regulatory agencies. See for example the Australian Prudential Regulatory Authority risk differentiation approach known as: PAIRS / SOARS. PAIRS is the Probability And Impact Rating System, while SOARS is the Supervisory Oversight And Response System.
context_section_description: Explicitly considering the likelihood and consequence of the risk of regulatory non-compliance
  Some regulators vary regulatory risk differentiation approaches by mapping suggested remedies to an entity's perceived risk of non-compliance.  This approach has been used by the Australian Prudential Regulatory Authority, the Australian Taxation Office and the UK Pension Regulator
  Explicitly considering the likelihood and consequences of an entity possibly breaking a law is a requirement of the UK Statutory Code of Practice for Regulators which emerged from the 2005 Hampton Report "Reducing administrative burdens – effective inspection and enforcement". The later Macrory Review "Regulatory Justice – making sanctions effective" effectively codifies the Ayres and Braithwaite Compliance Pyramid into the UK Regulatory Enforcement and Sanctions Act 2008.
  In these compliance models the possibility of entities breaking a law has both a likelihood of occurrence and a consequence of occurrence, known as a 'risk event'. Considering entities' likelihood of not complying and the consequences of their not complying usually provides a 'power distribution' of a few large consequence or higher likelihood clients and many more lower consequence/likelihood ones.
  This can be represented as a scatter plot on a risk matrix, as shown in the adjacent diagram.
  The scatterplot risk matrix to the left shows that most entities are compliant most of the time – in other words, assessed as both lower consequence and lower likelihood of their not complying with the law.
  From a risk management perspective the regulator has a more significant interest in higher consequence clients or events than lower consequence. The next two diagrams build on the scatterplot diagram to the left.
  In this example, The ATO links its strategies to the likelihood and/or consequences of entities not complying with a law. The ATO risk matrix to the left shows how the ATO divides its clients into four categories, and allocates appropriate detection strategies to each category.
  These strategies are proactive and continuous for higher consequence, reactive and periodic for lower consequence. The strategies are reviewing for taxpayers more likely to break the law, and only monitoring for those less likely.
  The diagram to the left provides more detail, giving names to each category of client, providing all of the strategies - deter, detect and deal with strategies, and the strategies' associated activities.
  It is important to note that the boundaries between category are able to be moved to allocate more or fewer clients to each category. It is normal to see fewer higher likelihood and/or consequence clients rather than 50% of the population or 50% of the assessed likelihood or consequence. In other words, the boundary is shifted so there can be a strong focus on the few assessed to be higher risk.
  This allows more resources to be allocated to more intensive strategies focusing on higher risk entities, providing an incentive to entities to want to be seen to be compliant. The robustness of the risk assessments, and the quality of the data on which the assessments rely, are therefore very important.
  The diagram below shows how end to end risk management steps (from ISO 31000) align with risk differentiation and the risk bow-tie.
caption: Scatterplot of ratings of risk of entities breaking a law
exif: {}