It is an irony of modern business that regulation, a concept designed to reduce risk by protecting the interests of corporates, customers and society at large, has itself become one of the most serious risks that companies face. From dealing with unfamiliar regulatory frameworks in overseas markets to scanning the environment for new threats, regulatory risk management has become a time-consuming and costly activity that demands board-level engagement and a rigorous approach.

Executives have long complained of a growing compliance burden but, in recent years, their protests have become increasingly vocal. Both companies and industry groups have pointed out that regulation can sometimes be disproportionate, inconsistent or lead to unintended consequences. In some cases, they may feel that regulators can lack accountability and transparency, or that insufficient consultation takes place before new rules come into force.

There is also the issue of complexity. As businesses around the world deepen their international reach, they fall under the influence of new regulatory environments, which can lead to a proliferation of overlapping, possibly conflicting compliance obligations. Extended business networks and supply chains add an additional layer of risk. If a partner fails to comply with some aspect of regulation, it is not just the company at fault that can suffer reputational damage, but the organisations that contract with it as well.

Increasingly, therefore, companies must take heed not just of their own compliance, but that of the key companies with which they deal. For companies in the financial services industry, the problem of regulatory complexity is of particular salience. As regulators prepare their response to the worst financial crisis in a generation, it is highly likely that the sector will face a new set of constraints, possibly involving measures such as tighter liquidity requirements or higher capital ratios to take into account off-balance sheet vehicles. Other heavily regulated industries, such as pharmaceuticals and utilities, have also traditionally borne a heavier burden than most, as have small businesses, which may lack the resources to deal with time-consuming and costly form-filling and inspections.

Ultimately, however, no company is immune from the impact of regulation. At one level, it is clear that business bears a significant cost in its efforts to comply with rules promulgated by governments and regulatory bodies. For example, according to the British Chambers of Commerce, the cumulative cost to business of new regulation in the UK since 1998 is £65.99bn. The scale of the regulatory sector was indicated by the Hampton Review, published in 2005 to consider the scope for promoting more efficient regulatory approaches. It found that, in the UK alone, there are 674 national and local regulatory bodies, which together employ 61,000 people.

Whatever the direct costs of dealing with regulations, the extent of the burden can vary considerably depending on a firm's specific approach to addressing its obligations. Some companies will have a streamlined, highly efficient system for managing their international compliance requirements. By adopting a unified approach to regulatory risk management, companies can minimise costs, maximise efficiency and reduce their risk exposure. Such firms, though, are in the minority. More often, there is considerable duplication of cost and effort as organisations attempt to deal with the requirements of multiple regulatory bodies across their operations.

In order to assess current concerns and approaches to regulatory risk management, the Economist Intelligence Unit conducted a survey of senior professionals with responsibility for risk on behalf of ACE, KPMG, SAP and Towers Perrin, and held an advisory board meeting of senior risk executives to discuss the survey results and provide further input. From this process, a number of key findings emerge:

• Companies support the concept of regulation but, as a category of risk management, it causes grave concern.
• The key problem with managing regulatory risk is complexity.
• Regulatory risk management is consuming a growing amount of time and resources.
• There is overall satisfaction with the way in which regulatory risk is managed, but certain weaknesses and inefficiencies persist.
• Companies plan to invest in people, processes and technology to improve regulatory risk management.