Submission to Joint Standing Committee on the NDI

Inquiry into the NDIS Quality and Safeguards Commission

Kai Sinor and Louise Butler, July 2020

Introduction

Kai Sinor is a practicing solicitor with MPS Law specialising in administrative law and regulatory matters. Prior to joining MPS Law, Kai was Assistant Director, Compliance with the NDIS Quality and Safegards Commission (the Commission) in South Australia for a period of one year from the Commission’s establishment in July 2018. As Senior Lawyer at MPS Law he provides legal services to businesses in the disability sector on NDIS and related regulatory and commercial law matters. Kai has worked across a range of regulatory and investigative settings, including the UK’s Competition and Markets Authority, inquiries into deaths in custody and Aboriginal and Torres Strait Islander Corporations.

Louise Butler is a Teaching Specialist in the School of Social Work at Flinders University. Louise’s most recent past position was Director, Behaviour Support with The Commission in South Australia for a period of eighteen months from inception in the state in July 2018. This followed a career in Disability related roles in South Australia and the United Kingdom.

Kai and Louise collaborate to explore opportunities to contribute to the safeguarding of people with Disabilities and their supports. This is primarily achieved through enhancing the capacity of Registered NDI Providers to understand and comply with their regulatory obligations as outlined in the National Disability Insurance Scheme Act 2013 (Cth) (NDIS Act), NDIS rules and related instruments.

Louise and Kai gained unique insights into the operations of the Commission through the early establishment phase and through their current roles supporting and advising Providers and participants to navigate the new regulatory framework.

The observations and recommendations provided are the result of reflections on the expertise gained in this area and observations regarding how the service may benefit from adaptations or enhancements.

TOR #1

Monitoring, investigation and enforcement powers available to the Commission and how these are exercised in practice

Constraints on the power of delegation impact how statutory powers are deployed

• Subsection 202B of the NDIS Act limits the NDIS Commissioner’s power to delegate compliance and enforcement powers and functions to staff who are SES employees. This increases the administrative burden of decision-making and planning processes relating to the exercise of these powers (briefings, meetings, updates etc.). Where such powers are exercised, close oversight and monitoring by senior management follows.

Page 2

In a field of nascent regulatory practice, control and supervision of the exercise of enforcement powers is appropriate.

However, s 202B centralises administrative control of a suite of regulatory powers. We consider that centralised administrative control impacts how responsively some regulatory tools can be deployed. In particular, powers typically used for ‘lower’ order compliance problems, such as compliance notices, civil penalty infringement notices and monitoring (inspection) warrants. To the extent there is caution, reluctance or difficulties exercising these powers in appropriate cases, the regulatory strategy shifts toward consultation, persuasion and the provision of technical assistance. While a compliance orientated approach is consistent with the policy design for the regulatory framework, this may reduce the credibility of the sanction.

TOR #2 Adequacy and effectiveness of NDIS Code of Conduct and NDIS Practice Standards

The NDIS regulatory architecture has unusual characteristics. It consists of the NDIS Act, “rules” and “guidelines” prescribing matters under the Act, which also form part of the legislation. Supporting guidance is set out in policy and “guidance” (informal guidelines) produced by the Commission. As regulator, the Commission is responsible for administering the Practice Standards and Code of Conduct. However, in practice the substantive task of interpreting and applying the Practice Standards is carried out predominantly by Approved Quality Auditors (auditors).

The intent of the regulatory design is to devolve routine compliance evaluations away from the Commission to auditors. From a compliance perspective, the audit process enables providers to interact with auditors about what is required and in doing so, strengthen their understanding of how regulatory requirements are interpreted and applied. These interactions are important because it provides a ‘feedback loop’ to shape education activities and build regulatory intelligence on those areas where there are higher risks of non-compliance and the drivers of compliance.

By decentralising the audit function, the Commission’s ability to monitor how regulatory requirements are interpreted and gather intelligence from the ground is diminished. We do not suggest that quality audits be centralised, but work is required to close the ‘feedback loop’. Consideration of mechanisms for ‘quality assuring’ how auditors interpret and apply the Practice Standards and remedies that are available in relation to auditors’ decisions is also required. This is discussed further at Attachment A.

Page 3

An area we suggest also requires further work is the Commission’s capabilities to undertake proactive, risk-based, compliance monitoring.

In particular, the criteria for assessing provider risk. A key challenge in developing and implementing ‘risk-responsive’ compliance monitoring is the absence of comprehensive and reliable data. Although datasets may develop over time within the Commission, the immediate challenge is to develop indicators of risk so that systems and processes can be put in place now to capture and store information that is relevant to those indicators.

The NDIS regulatory architecture is a ‘principles-based’ regulatory framework

By nature, principles are expressed broadly. This, coupled with decentralised third-party audits, affects how regulatory requirements are interpreted and applied, and how enforcement is carried out. In a principles-based regulatory framework, interactions between the regulator, regulated and others (i.e., quality auditors) is central to developing a shared understanding about meaning and what is required. This is discussed further in Attachment B and Attachment C at [6]-[10].

In practice, the interpretation of meaning of the NDIS Practice standards is anchored in a system focus

The NDIS has a deliberate focus on internal systems of management and controls relevant to quality, safety, and human rights. This is to be expected in a principles-based regulatory framework, which tends toward a stronger focus on internal management systems. The focus towards management systems occurs because these systems contain the internal rules, processes and other controls that are preconditions to compliance with, and fulfilment of, broader objectives involving abstract concepts such as ‘dignity’ and ‘choice and control’.

Despite the strong focus on individual outcomes and person-centred care within the Practice Standards, audit and other compliance testing may focus more on ‘concrete’, objectively measurable elements that are identified as markers of quality and safety in service provision. This is particularly the case where there is limited understanding of meaning and purpose of rules that express broadly stated abstract concepts. Attachment A at [4]-[5] suggests preliminary research to elicit feedback from auditors on those areas of the Practice Standards that are difficult to interpret or apply.

Compliance is a process, not an event

Currently, the primary mechanism for ‘testing’ compliance is through third-party audits. We note that the timing and focus of both quality audits and (to a lesser extent) ‘for cause’ inspections is reasonably predictable. This creates a tendency for providers to view compliance as a time-bound event.

A compliance approach focuses on repairing harm, correcting defects, securing future compliance. The goal is preventative (not punitive) and the style is conciliatory and relies on persuasion, education, negotiation and bargaining to attain results. Although enforcement powers may be intimated, compliance-orientated strategies do not rely on the use of sanctions.

Partnership

Partnership is therefore pivotal and the regulatee must be both willing and able to accept responsibility for ensuring standards are met on an ongoing basis throughout the ‘process’.9

What counts as ‘compliance’

What counts as ‘compliance’ is not simply a matter of conformity to a rule; compliance is a matter of interpretation; interpretation of rules and interpretation of facts.10 Interpretation occurs through an ongoing, long-term, process that evolves through different forms of interaction between the regulator, regulatee and others, that occur over time. Refer to Attachment B for discussion of the factors that influence the compliance process in a principles-based regulatory framework.

Risk-Based Compliance Monitoring In A Principles-Based Regulatory Framework

Faced With Finite Resources,

Risk-based prioritisation in inspection and enforcement activities is indispensable. There are two preconditions for effective assessment and prioritisation of risk: (a) criteria to assess individual risk and rank according assessed risk levels and (b) data on all (or a majority) of regulatees that allows assessment of their individual level of risk.

Criteria For Assessing Risk

To our knowledge, the NDIS Commission does not yet have an organisational wide framework for systematically analysing provider risk or tools and guidelines to assist enforcement staff to assess the relative risk of different types of violations and rank them according to the potential risk they present. If the absence of framework and useable tool is not available to Commission staff then this is a critical gap.

Data To Assess Risk

The OECD recommends that, in the absence of comprehensive (and/or fully reliable) data, agencies should rely on interpreting what data exists.11 In these circumstances, the minimum objective is to establish what sectors or market segments appear to generate or cause the most harm or have the greatest potential for non-compliance.

Proactive compliance monitoring

In principle, reactive (‘for cause’) inspections should be a minority of the total volume of inspections carried out and base-level frequency of inspections is required to maintain credible threat of detection.12 Unannounced inspections led by the NDIS Commission should be a central feature the compliance program. The vast majority of these inspections should be proactive, with targeting based on risk assessment (which are based on data from a variety of sources).13 Risk factors taken into account for this targeting should include at least intrinsic risk of the activity, scope of operations and vulnerability factors (location, population served, communication difficulties).

Relevantly, we suggest that the Netherlands Ministry of Justice’s ‘Table Of Eleven’ can be usefully adapted as a risk assessment tool for NDIS quality and safeguarding. This is discussed further in Attachment D at [7].

The balance between clarity, precision, complexity and use of different ‘rule’ types impacts implementation of regulatory strategy

Generally, imprecise rules with broadly framed language offer flexibility at the expense of clarity and certainty.

The use of principles creates space within regulatory requirements in which providers, auditors and the NDIS Commission can exercise choice and discretion. With this discretion comes the need and responsibility to work out what needs to be done. A challenge for regulatory strategy is to strike a balance between guidance (to give certainty and reduce interpretive risk) and encouraging providers to think for themselves. As noted above at [7], auditors also have a pivotal role in the interpretation of meaning under the regulatory design.

If changes to instruments that contain the NDIS Practice Standards or NDIS Code of Conduct are contemplated,

sconsideration should be given to the effect of how changes to the rule dimensions may affect the choice or implementation of regulatory strategy. This is discussed further at Attachment C at [1]-[2].

Clarity of the NDIS Code of Conduct and when it is applied

The broad aim of both the Practice Standards and Code of Conduct (the Code) is to establish minimum standards. Requirements of the Practice Standards are stated broadly, enabling a diverse range of entity and business types to self-adapt, where required. The requirements of the Practice Standards are opaque, but this is consistent with the objective of standard setting.

The Code applies to both registered and unregistered providers and is thus broader in application. While the Code also sets standards, it is applied primarily as a tool to sanction behaviours. In particular, workers, unregistered providers, and those registered providers whose conduct is not appropriately sanctioned using other regulatory tools. From a broader policy perspective, as sanctioning tool, the Code should be applied as punishment for individual or entity misconduct and for retributive and deterrent purposes.

It is notable that National Disability Insurance Scheme (Code of Conduct) Rules 2018 contain vague descriptions that lack clarity. Key standards and requirements to clarify what is required, including examples of contravening conduct, are provided in the NDIS Commission guidance. In its present form, applying the Code without reference to the NDIS Commission’s guidance is difficult. Moreover, as internal review of determinations under s 73V (Code of Conduct contraventions) is not available, disputes as to meaning and application of the Code are contested in court.* This increases the transaction cost of administering and enforcing the Code and interpretive risk for the NDIS Commission.* Where there is doubt in how the Code applies, there is an increased likelihood that a sanctioned provider will contest its interpretation. This may decrease the readiness of enforcement staff to utilise it as an enforcement tool.*

Subsection 73ZS(3) of the NDIS Act requires that certain regulatory actions are published on the NDIS Provider Register (Register). Although the list of actions in subsection 73ZS(3) is exhaustive and does not include matters relating to enforcement of the Code, it is the intention

TOR #7

Any related matters

Engagement and outreach with First Nations peoples and their communities

25. To our knowledge, the Commission does not have a plan or strategy in place to guide its engagement with First Nations peoples. While the majority of First Nations people may reside in northern regions of Australia, initiatives to engage and make the services of the Commission known to communities in these areas should reflect an organisational wide approach. The heightened risks and other issues faced by First Nations people with disability was observed by the Disability Royal Commission in its recent issues paper. The lack of clarity in how the Commission will engage with and deliver services to First Nations people, particularly those in rural and remote communities, is concerning.

Recommendations:

• The Commission develop a framework for assessing risk that includes:
  • criteria for analysing participant and provider risk;
  • guidance for assessing violation types and ranking according to potential risks they present to (i) participants (ii) governance and operational management (iii) safe delivery of supports and services; and
  • indicators for the ‘drivers’ of compliance behaviours for provider risk profiling.
• Relevant criteria, policies or guidance for assessing risk are made available to regulatees and relevant stakeholders are periodically engaged to discuss these materials and the Commission’s approach / understanding of risks so that evolving hazards and threats are identified and properly addressed.
• Develop a program of inspection that is targeted by reference to indicators of participant and provider risk and which include a combination of announced and unannounced visits.
• Develop mechanisms for the Commission to review how third-party auditors apply the Practice Standards so that interpretations ‘on the ground’ are consistent with the regulator’s expectations. These mechanisms should also enable feedback to auditing stakeholders so that there is a shared understanding of meaning, application and purpose, particularly in relation to more opaque, rights-focussed requirements.
• Guidelines and/or templates in relation to audit reports be developed to (a) set standards for the level of detail and analysis that is to be provided (b) develop a shared understanding of audit evidence for different quality indicators (c) clarify information that must be provided to

“demonstrate corroboration of evidence…” and convey “evidence from documented records and interviews with stakeholders that can be substantiated….”

6. Review the appropriateness and effectiveness of complaints and appeals processes required under ISO 17065:2012 and/or JAS-ANZ. Whether these are adequate in circumstances where registration has been approved, but findings involving minor non- conformities are disputed by the provider.

                                                                    Kai Sinor
                                                           Senior Lawyer, MPS Law
   

rv1Ps Louise Butler Liability limited by a scheme approved Teaching Specialist Clinical Practitioner by professional standards legislation Flinders University

19 See National Disability Insurance Scheme (Approved Quality Auditors) Guidelines 2018 s 16(c)-(d) (‘AQA Guidelines’) which sets out ‘matters’ to be included in audit reports.

                                                                     7

ATTACHMENT A

Remedies for review of decisions of quality auditors under the National Disability Insurance Scheme (Quality Auditors) Guidelines 2018 are limited

1.

Under the statutory scheme, approved quality auditors made ‘certification’ or ‘verification’ decisions to the NDIS Commissioner, who in turn makes a decision under s 73E of the NDIS Act. Decisions under s 73E may be reviewed by the Administrative Appeals Tribunal, however decisions of auditors under s 18 the National Disability Insurance Scheme (Approved Quality Auditors) Guidelines 2018 (AQA Guidelines) are not. Further, as the AQA Guidelines are not a legislative instrument, scope for review of the conduct or decisions of auditors under the Administrative Decisions (Judicial Review) Act 1997 (Cth) (ADJR Act) is also limited.20

2.

Each Approved Quality Auditor (AQA) is required to have a documented process to receive, evaluate and make decisions on complaints and appeals.21 Process requirements for complaints and appeals about AQAs are set out in ISO 17065. There are no additional requirements or arrangements for the NDIS Commissioner to oversight complaints under the AQA Guidelines (or otherwise).22 How the ’Joint Accreditation System of Australia and New Zealand (JAS-ANZ) manages complaints from providers about AQAs is unclear.23

3.

As a result of the above, the following issues arises:

- disputes about non-conformances identified at audit are resolved (primarily) between
  the AQA and the regulatee. Mechanisms to support a shared understanding of how
  standards are applied or to monitor consistency of auditors' interpretations are not yet

developed;

- where a non-conformity is reported to the NDIS Commission, a provider can seek
    internal review but only in relation to the 'final' decision to refuse registration under
  s 73E;24

- if the decision under s 73E is to approve the application for registration, internal review
      is not available and other remedies are limited;25

- where the task of interpreting the Practice Standards is polycentric, mechanisms to
     promote shared understanding of meaning and application do not exist, and remedies
        for review of auditors’ decisions are unclear, the interpretive risk for the regulatee is
       higher.

• where interpretive risk for the regulatee is high it is more difficult to encourage innovation and apply a strengths-based approach to regulation.

Closing the feedback loop

4. As indicated above, the absence of a ‘feedback loop’ or other mechanisms for understanding, monitoring and providing guidance to auditors on how Practice Standards are interpreted creates the potential for regulatory standards will be applied inconsistently. This creates a risk of divergent systems and practices that do not meet what the regulator expects and is required to assure quality and safety.

5. While the Commission’s limited resource envelope is rightly focussed on provider and participant education, activities to educate auditors should not be forgotten. We consider that the first step is to undertake research to better understand which elements of the Practice Standards require elucidation or are more difficult to apply in practice. In our view, this information could be obtained by developing case studies and inviting auditors to participate in an online survey that requests their views on how the Practice Standards are applied in different case study scenarios. Analysis of this data would then indicate the knowledge gaps or key areas of uncertainty within the NDIS audit community.

ATTACHMENT B

The NDIS architecture is a ‘principles-based’ regulatory framework

1. Several characteristics of a principles-based regulatory framework impact how the practice of regulation is carried and the processes by which regulatory requirements are interpreted, applied and enforced.

2. Since requirements are expressed broadly, a degree of uncertainty is inherent and providers face a strong interpretive risk (the risk that the NDIS Commission or auditor will not agree with how they have interpreted and applied the rules in their systems). The regulator must therefore adopt a responsive mode of supervision and enforcement, in which negotiation as to meaning, application and purpose plays a central role and in which the focus is on the outcome to be achieved.

3. The following is required, or will enable, effective principles-based regulation:

   a. close engagement between regulator and regulatee based on mutual trust;

   b. providers are encouraged to go beyond minimal compliance with regulatory requirements;

   c. outcomes and goals are clearly communicated by the regulator;

   d. appropriate distribution of responsibilities and allocation of discretion within the regulatory regime;

   e. enforcement regime is predictable and compliance focussed.26

4. While all of the above involve questions of regulatory strategy, [a]-[c] are notable in that they do not immediately require the use statutory powers or adjustment to the regulatory architecture; strategies to achieve these aims can be implemented without intervention from policy makers or the legislature.

5. Predictability of the enforcement regime is particularly important because of the vague and uncertain nature of what principles require in ‘borderline’ cases. A predictable, compliance focused enforcement regime is necessary to reduce providers’ interpretive risk and give assurance that unwarranted sanctions will not be imposed on the ‘well intentioned and ill-informed’ provider.

Julia Black, ‘Rise, Fall and Fate of Principles Based Regulation’ (2010) (Working Paper No 17/2010, Law Department, London School of Economics, Society and Economy Working Papers, 2010) 6-8.

ATTACHMENT C

Dimensions of administrative rules

| Table 1 – Dimensions of administrative rules | | |-| |a. Status and force: a rule may purport to have full legal status and force, evidential value or to summarise good practice; it may exhort or merely advise. |b. Character: whether it prohibits, permits, discourages or mandates behaviour. c. Linguistic structure: whether the language the rule uses is vague or precise, whether the rule is simple or complex in its requirements. Linguistic structure also impacts clarity – whether a rule is phrased in everyday language, once and easily understood or the rule is voluminous, with highly technical language couched in jargon or legalise. Clarity of the rule is increased by drafting rules with words that have well-defined and universally accepted meanings and language that is clear and easily understood. Precision and clarity of the rule promotes transparency and accessibility by clearly articulating how the it applies when people are similarly situated and limiting the discretion available to the official decision makers.

Any combination of dimensions is possible, subject to any overriding objectives (i.e. enforceability) and inevitable trade-offs. Crucially, not all trade-offs are equally acceptable. For example, a transparent and precise rule may assure consistent treatment of similar cases, but may be too narrow in its application and thus under inclusive. Varying the degree of precision with which a rule is expressed also impacts the primary behaviour of the regulatee, The transaction costs associated with administering the rule and the type of regulatory approach that is adopted.

The optimal balance between these rule dimensions is not discussed here. However, we emphasise that understanding how enforcement officials exercise their functions is central to understanding how the regulatory system operates and thus the changes (if any) that are required to how regulatory requirements are expressed. It is therefore important to develop the clearest possible understanding of and/or objectives for:

Relationships Between Enforcer, Interpreter And Regulatee

a. relationships between the enforcer (the Commission), interpreter (quality auditors) and regulatees (providers);31

b. discretion afforded to those administering or enforcing the rule;

c. substantive aims (i.e. whether the intended objective is to exhort or mandate);

d. ‘transaction costs’ (i.e. time and resources to administer, enforce or manage disputes about rules).32

Principles33

3. Any combination of the dimensions in Table 1 above is possible, however there are three elements of structure that characterise a norm as a principle: (1) precision (2) complexity and (3) clarity.34 Varying choices as to these elements of structure produces regulatory rules of three broad types: bright line rules, principles or detailed rules.35

4. Specific and absolute ‘bright line’ rules are attractive to regulators because they enable the enforce to clearly identify how the rule has been breached. The key disadvantage is the narrowness of application and potential for under-inclusiveness.36

5. The use of principles in the NDIS regulatory architecture offers three key advantages:

   a. Principles create congruence between the substantive content / regulatory objective for what is communicated and the promotion of behaviour that will achieve those objectives.37

   b. By requiring the interpreter to focus on outcomes, they minimise scope for regulatees to engage in “creative compliance” or “gaming” of regulatory requirements.

   c. They can be applied and interpreted flexibly to a diverse and evolving NDIS provider market.

Tools And Sanctions Available For Different Compliance Behaviour

6. Under a neoclassical economics view, regulatees are rational and self-interested; regulation serves to fix market failures and enable interventions when negative externalities are such that consumers need protection. On this view, it assumed that where the regulator poses a credible risk of detection, enforcement and threat of sanction, compliance behaviour of the regulated (rational) actor naturally follows. Contemporary regulatory practice acknowledges the flaws in these assumptions and refocuses attention and strategies to the ‘motivational’

postures’ that drive compliance behaviour. These strategies are often depicted in the

‘regulatory pyramid’. The peak of the pyramid represents the ultimate constraint on pursuing a course of action that is in breach of regulatory standards.

The diagram below illustrates how different tools can be applied to respond to different types of conduct and motivational posturing (non-compliance behaviour).

                                       Education, Persuasion, Compliance Support

7. The bottom of the pyramid represents lower-order breaches that are dealt with through education or persuasion; these regulatees are generally willing and able to comply. The top of the pyramid typically corresponds to offences or contraventions that are serious (i.e. reflect significant risk) where the regulatee is culpable or where the regulator has determined that the broader deterrent effects of a sanction are appropriate. The regulator may respond to move a recalcitrant regulatee upward through pyramid if ‘soft’ interventions at the lower levels of the pyramid fail to achieve the desired response. Conceived in this way the pyramid provides a useful depiction of how the mantra of ‘responsive regulation’ is operationalised and a broad framework through which the regulator’s finite resources can be prioritised.

8. Characterisation of the drivers of regulatees’ behaviour varies. Even within a single sector such as the NDIS there is variation between the motivational postures of registered and non-registered providers, sole providers, SMEs and large business or between providers in remote, rural and urban areas. We do not profess detailed insights on these issues. For present purposes, we are concerned with the type of rule configuration that will be more useful with regulatees who fail to comply for different reasons. For the purposes of our analysis, we identify three broad categories of provider behaviour:

Well intentioned, ill-informed provider is (in the absence of serious hazards, risks to participant health, safety or wellbeing) generally treated sympathetically and is commonly a sole provider or SME business. For these providers, inspecting officers combine

38 Providing it is a credible sanction, that is, those being regulated believe that the regulator can and will use this power, it serves a number of functions. In a societal sense, it signals the seriousness of a breach of rules. It reminds those being regulated of their obligations and of the course of action they should pursue, as agreed in the social compact at the base of the pyramid. Should social pressures fail, economic pressures come into play. It is costly to escalate to the top. It is rational for the regulatee not to carry the costs of non-compliance, and return to a cooperative stance at the base of the pyramid that respects the law sooner rather than later. See Mary Ivec, Valarie Braithwaite et al, ‘Applications of Responsive Regulation in Australia and Overseas: Update’ (2015) (ANU Occasional Paper, March 2015) 7-8.

negotiation with advice, education and information-giving.

Inspectors may agree a timetable for implementing corrective/remedial actions and undertakings (non-statutory) as to what needs to done. In the absence of other risk factors or concerns, inspectors are disinclined to get too ‘legalistic’.

Ill-intention, ill-informed provider also typically a SME and may have a history of repeated low order, technical breaches (i.e. failing to lodge reports within prescribed timeframes). ‘Ill intentions’ may emanate from a single (dominant) member of the governing body, or

Problematic provider or irrational non-complier is usually recalcitrant. The provider may vary in intention or degree of knowledge but is characterised by the fact that they are inherently difficult to deal with.

9. Precise, ‘bright line’ rules are conducive to a sanctioning approach if it is clear on the face of the rule what conduct is required or prohibited.39 Thus they are more effective for “irrational non-compliers” because they enable the enforcer to clearly articulate how the rule has been breached.40 However, studies show that a mass of detailed rules may increase discretion and rather than facilitate enforcement, it may hinder it due to the volume of rules that must be monitored.41

10. In contrast, general rules (i.e. principles) containing a broadly stated duty or obligation or a vague as to manner, process and which impose evaluative standards implicitly confer discretion to those applying the rule (including regulatees) to make a judgement as to its application in particular circumstances. Such rules make it easier for a compliance approach to be adopted, thereby supporting regulatory practices of persuasion and negotiation as to what conduct is required.

11. In our view, any changes to how requirements within the Practice Standards or Code of Conduct (or other instruments) are expressed should be framed by careful consideration of these issues discussed above.

ATTACHMENT D Risk-based compliance

1. Risk is understood here as the combination of the likelihood of an adverse event (hazard, harm) occurring and the of the potential magnitude of the damage cause (combining numberof people affected and severity of damage for each). This means that typically, highest riskcategories will comprise objects for which both probability and potential magnitude are high –but also in some cases, where probability is low, but magnitude of damage would bextreme and result in severe harm.

2. Risk-based compliance is especially important in supervisory regulation because it is notpossible to inspect each and every provider. In the absence of comprehensive and/or fullyreliable data, the regulator must rely on interpreting what data exists (at least to establishwhich sectors appear to generate the most damage).

39 See Black (n 8) 7. 40 See Karl N Lewellyn, Jurisprudence: Realism in Theory and Practice (University of Chicago Press, Chicago, 1962). 41 See Braithwaite (n 29).

3.

Risk assessment and risk management require resources and expertise, and to be continuously updated using the results of inspections, monitoring, and analysis of all available sources of information on ongoing trends in the relevant field. As the OECD notes, this may require governments to ensure that regulatory agencies have a dedicated unit or teams specifically in charge of risk management, with adequate resources to perform their task effectively. In addition, OECD recommend that regulators collect and use the following:42

a. Criteria to assess the risk of individual businesses and rank them according to assessed risk level.

b. Data on all (or at least most) businesses allowing to effectively assess their individual risk level.

c. Planning and resource allocation mechanisms so that inspection visits are effectively planned based on the risk level, and resources are rationally allocated

d. Updating process so that the risk-profile of each business is regularly updated to incorporate new information, and risk criteria are modified based on new statistical data on hazards, possible damages etc.

e. Consistently-compliant businesses are treated as correspondingly lower risk, and inspected less frequently (“earned recognition”).43

f. Develop and track indicators that give “early warning” of changes in both the likelihood of occurrence and the magnitude of consequences.

Inspections

4. Inspections provide opportunities for regulatory enforcement agencies to provide information and advice, suggest cost-effective remedies on site, increase the agencies’ understanding of the businesses they regulate – and in this process, allow to develop trust relationships between regulators and regulated entities.

5. Relatedly, regulatory enforcement agency need some compliance (and compliance-related) information on all regulated entities – including regulated entities with good compliance records – in order to monitor and measure regulatory compliance and performance in a comprehensive manner. This in turn allows tracking the evolution of risks, and whether their risk assessment models remain valid – and also to feed into the “responsive regulation” approach.

6. In principle, reactive inspections should be a minority of the total volume of inspections carried out. The vast majority of inspections should be proactive, with targeting based on risk assessment (which are based on data from a variety of sources).44 However, this is difficult whether data and tools to support risk analysis are not available.

   42 OECD Regulatory Enforcement Best Practice Report (n 11) 28-29. 43 See generally OECD Regulatory Enforcement Best Practice Report (n 11) 33-36. 44 See OECD Enforcement and Inspections Toolkit (n 13) 21. Risk factors taken into account for this targeting should include at least intrinsic risk of the activity, scope of operations and vulnerability factors (location, population served). In addition, the OECD recommends that design of inspection program include randomised sampling of providers who do not meet the ex ante risk assessment threshold, so that the regulator can obtain insight into providers’ operations and systems generally.

Page 16

Table of Eleven

7. Developed by the Dutch Ministry of Justice, the ‘Table of Eleven’ (the Table) was developed to assist the government to determine whether new legislation could be enforced in a way that would leave to compliance. The Table lists 11 factors that behavioural science showed influenced compliance. The Table was later adapted to reflect a more holistic view of compliance and the factors that influence how individuals’ and businesses’ everyday motivations, characteristics and business models interact to influence their perceptions of regulatory obligations, enforcement and, ultimately, compliance.