Regulatory Risk

Risk of change in regulations or laws that any business or investor would expose to such types.

Author: Osman Ahmed
Osman Ahmed
Osman Ahmed
Investment Banking | Private Equity

Osman started his career as an investment banking analyst at Thomas Weisel Partners where he spent just over two years before moving into a growth equity investing role at Scale Venture Partners, focused on technology. He's currently a VP at KCK Group, the private equity arm of a middle eastern family office. Osman has a generalist industry focus on lower middle market growth equity and buyout transactions.

Osman holds a Bachelor of Science in Computer Science from the University of Southern California and a Master of Business Administration with concentrations in Finance, Entrepreneurship, and Economics from the University of Chicago Booth School of Business.

Reviewed By: Austin Anderson
Austin Anderson
Austin Anderson
Consulting | Data Analysis

Austin has been working with Ernst & Young for over four years, starting as a senior consultant before being promoted to a manager. At EY, he focuses on strategy, process and operations improvement, and business transformation consulting services focused on health provider, payer, and public health organizations. Austin specializes in the health industry but supports clients across multiple industries.

Austin has a Bachelor of Science in Engineering and a Masters of Business Administration in Strategy, Management and Organization, both from the University of Michigan.

Last Updated:October 31, 2023

What is Regulatory Risk?

Risk of change in regulations or laws that any business or investor would expose to such types. For example, a non-diversifiable systematic risk arising due to market changes or a diversifiable unsystematic risk arising within the industry or company.

While systematic risk is arbitrary, unsystematic risk is manageable and under control.

Regulatory risk occurs due to systematic risk. Systematic risk includes changes in the laws and regulations and impacts the business, industry, or market. It comes from alternating the rules and regulations.

The adjustments in laws and regulations made by the government of a country or a regulatory body that has a high authority impact on the business. In terms of the operating costs and expenses or the degree of competitiveness in the market by altering its nature.

Which sometimes exposes a firm to bankruptcy and hits the business model and nature of the company because of competition and regulations changes.

This harshly affects international business and decreases investment ability in many forms, limiting its growth.

Regulatory risk is often connected with legislative/legal risk because it is a risk that occurs from changing the rules, regulations, and legislations by governmental bodies, which impacts business growth and continuity significantly. 

Also, such impact from these changes would affect investors, as mentioned earlier, especially due to the taxes that would affect the level of return and influence their investment decisions as it might not be as profitable for them as before. 

Nevertheless, even if there are no changes in some rules and regulations, this does not mean that a firm or an investor should not make their regular assessment and plan ahead of time. In the end, there should be expectations as the business world has an immediate and dynamic environment.

Managing Regulatory Risk

When this risk occurs, the motive behind this change urges the government to apply the changes, or the market nature alters the rules. 

The government is inclined to change the regulations to reduce the monopoly market and high industry competition. This is where it involves changing and lessening the impact of such a market nature.

The market or industry can be in market forms, including monopoly, oligopoly, perfect competition, and monopolistic competition. Understanding these types help in determining the intensity of competition and the business model nature of a company.

Thus, the government imposes antitrust laws to reduce a firm's market power, especially for companies like Google, Microsoft, Amazon, and Meta-Facebook, to allow others to trade and enter the market and avoid monopolistic intent freely.

These rules ensure that even mergers and acquisition (M&A) firms do not gain power and form monopolistic power over the markets. This is because they have a higher strength than others. In addition, the rules are designed to reduce any manipulation by a company or companies in terms of prices and quality. 

Generally, antitrust laws are federal laws aimed at regulating and controlling companies’ practices to be within the limits of allowing new market entrants and reducing monopolistic action. 

In the U.S.A, the main statutes are the Clayton Act of 1914, Sherman Act of 1890, and Federal Trade Commission Act of 1914; each aims to limit actions that involve M&A manipulation, fixed prices, cartels, and monopolization activities.

Another aspect the government considers to change the regulations is the reporting standards and companies’ disclosure and transparency. It concerns the accounting cycle and the requirements established by the GAAP for companies in the U.S.A.

Generally Accepted Accounting Principles-GAAP represents the accounting standards accepted by the Security and Exchange Commission-SEC; However, the SEC still intends to apply and follow the International Financial Reporting Standards-IFRS.

SEC imposed statutes to avoid defaults, including the Securities Exchange Act of 1934 as it was created to implement multiple regulations:

These have different intentions to regulate companies' performance in accountancy and managing funds and securities, which would affect the country's economy

Regulatory Risk Differentiation

Understanding the risk and its purpose is important, but gaining knowledge about managing it and ensuring the compliance of these entities when regulation is enforced is not less important.

Regulatory risk differentiation is a systematic process implemented by the respective regulatory authority of a country that aims to deal with noncompliance firms at various levels depending on the risk assessment results provided by the regulators. 

These entities are under the provision of authority and its control that can be individuals or companies, including multinational corporations that operate within the limitations of the regulator's jurisdiction. 

Along this process, the regulator's role can be as a form of law execution agency, and it mandates the regulator to implement a stringent risk assessment directly. 

The risk assessment includes determining and inspecting any event that might signal a warning sign and making a solid judgment about the sensitivity to risk and ability to absorb outcomes as a consequence of the risk through evaluating it. 

This process can also be known as the compliance model designed by the Australian Taxation Office to understand consumer behavior in relation to the impact of a business or market by implementing a relatively proper strategy to control the overall interaction between both.

Also, the Australian Prudential Regulatory Authority-APRA is an independent body and statutory authority to control and supervise financial institutions and banking systems to maintain a stable and efficient economic system across the nation, established in 1998.

It has its risk assessment model of what is called: the Probability And Impact Rating System-PAIRS, introduced in 2002 along with the Supervisory Oversight And Response System-SOARS.

These are tools to evaluate risk and, as a supervisory response, make better judgemental opinions about risk and take appropriate action when needed. 

However, APRA decided in early 2019 to adopt a new framework called the Supervision Risk and Intensity Model-SRI that suits the contemporary era by replacing these previous two models.

Nevertheless, managing risk arises from regulation changes. It ensures that entities align with what is recently imposed and can be determined and measured through different models and risk differentiation frameworks used by the Australian Taxation Office. 

Regulatory risk has a two-way perspective in which it affects the companies and the government itself and needs control from both sides, which is the reason for discussing the compliance risk. 

This risk significantly impacts regulators, businesses, and investors. To maintain the alignment for these new rules, there should be a provision by these people themselves to ensure they are meeting the requirements.

Regulatory and Compliance Risks

Compliance risk is linked with regulatory risk because it refers to the risk that would be exposed by the company when it does not follow and implement the rules imposed by the authoritarian body. 

It is called integrity risk, which means a company's potential risk exposure to legal penalties or financial loss from the alignment failure in its activities according to the laws imposed relative to its industry or the applied benchmark standards and internal practices.

It is the risk that a firm faces when it breaches the established laws and violates them by the governmental body and regulator. 

One cause is improper management, inadequate control, and evaluation of internal practices that lead to negligence, human error, and miscommunication between employees and top management.

This requires a company with a lot of control and expertise, which could be a great expense for it, and incapable of doing so.

Thus, for risk management of the overall business to be accomplished properly, it needs to ensure the appropriateness and company's capabilities in meeting the set forth requirements established by the government and minimize risks of regulatory and compliance. 

Risk management is identifying, evaluating, and managing risks by minimizing the exposure of such risk by a firm, as such risks can stem from the economic or political factors that would affect the profit or loss of the business activities.

Because of the required continuous supervision, identifying the difference between both risks is helpful as compliance risk has a systematic approach and awareness of the existing rules. In contrast, regulatory risk has a strategic futuristic approach and abides by the regulators' laws. 

There is an interrelated relationship between risk management and regulatory and compliance risk, as they all affect each other. 

Compliance risk and risk management are very connected because both ensure a firm's ability to prevent itself from risks and avoid the occurrence of noncompliance with the stated laws and regulations. 

A company faces many risks due to improper internal management or external factors from changes in the laws set by the government. Still, the key takeaway is that a company should ensure continuous internal management to be ready for any outside variation.  

Researched and Authored by Noor HLinkedIn

Reviewed and Edited by Abhijeet Avhale | LinkedIn

Free Resources

To continue learning and advancing your career, check out these additional helpful WSO resources: