Regulatory Over-Compliance

Tactics of Organizational PoliticsMeetings and ProcedureA borderline tacticAlso known as Legal Moat, Privacy Pretext

Compliance or legal applies the strictest defensible reading of a rule to a rival's project, and the cost of meeting that reading slows or reshapes it.

Borderline: whether this move is justified depends on the situation, and only the person in it can judge.

An example

Having come up through agency distribution, the chief compliance officer of a life insurer thought the digital team's plan to sell term policies online in fifteen minutes outran the company's suitability and data rules. She wrote an opinion citing each clause and set out the strictest reading she could defend: human review of every applicant, a manual identity check, and in-country storage of all records. She estimated the cost of compliance and offered the digital team two routes to a lighter reading, an outside opinion or a question to the regulator. The agency channel's online quoting tool had been cleared the year before under a lighter reading, and she opened a review of it under the same standard. The launch budget rose from two million dollars to five. The chief executive, holding a written opinion about regulatory exposure, deferred the launch a year.

Why it works

Under the strict reading the rival's initiative gets worse: even if the team absorbs the work, the product arrives late, over budget, and stripped of whatever was ruled out. It also gets far costlier, in headcount, vendor fees, documentation, and remediation, all presented as following the rules. A written opinion outweighs any spoken objection, and pressing on against one exposes the manager personally. It needs one function holding the only interpretation, a rule ambiguous enough to support several readings, and executives without the expertise to question the strict one.

The thinking behind it

George A. Akerlof Akerlof's The Market for "Lemons": Quality Uncertainty and the Market Mechanism (1970) is about the advantage of knowing what the other side cannot verify. A compliance function holds knowledge of the rule that business leaders cannot verify, so its reading sets the terms they must work under. A credentialed outside opinion is the defense because it closes the gap, giving executives a second reading to weigh.

Jeffrey Pfeffer Pfeffer's Power in Organizations (1981) traces power to control of resources, information, and the decision process. Interpreting a regulation is control of information in a strong form: one function decides what the rule requires and therefore what a project costs. That position lets a compliance head reshape a rival's project without any authority over the business that runs it.

Robert B. Cialdini Cialdini's Influence (1984) describes the tendency to defer to people who appear to hold legitimate expertise or position. A chief executive holding a signed opinion about regulatory exposure defers to it, and few managers will press on against counsel in writing. That deference is also why the reading has to be one its author can defend before a regulator or an outside lawyer.

When it fits

Compliance or legal heads with interpretive authority, facing a project that carries real regulatory ambiguity and that they believe moves too fast. The rule must support the strict reading in good faith, and executives must give a written opinion heavy weight.

How to use it well

Write the reading down, with the rule, the clause, and why the strict interpretation is defensible.

  • Set out what the project would need to do to comply, and estimate the cost.
  • Offer a route to a lighter reading, such as an outside opinion or a question to the regulator.
  • Apply the same reading to comparable projects, and review any cleared under a lighter one.
  • Brief the chief executive on the exposure in plain terms.

A strict reading you apply to everyone is hard to argue with.

What it costs and where it backfires

Expect the business side to commission outside opinions, and if a credentialed one supports a lighter reading, your credibility on the next question falls. A reputation for using compliance as a club spreads fast. Consistency and candor are what make the reading defensible. Once you misstate what the rule requires, cite privacy or law to deny data you release freely to others, or hold the rival's project to a reading you waive for allies, the reading has become a pretext, and the comparison will end up in front of the board.

When it is used on you

Contest the reading and leave compliance itself alone. Document how the same rule was applied to comparable projects, ask for the clause and a written opinion, commission a credentialed outside opinion or ask a counter-authority to clarify, and take the comparison to the board or audit committee.

Back to the catalog