INTRODUCTION: COMPLIANCE AND THE “NEW GOVERNANCE” DEBATE
The notion that business organizations should be enlisted in their own regulation dates back at least to the 1980s. Influential research by scholars such as Robert Kagan and John Braithwaite, among others, emphasized perceived pathologies in regulation stemming from inflexibility in enforcement and an unnecessary attachment to formal rules (Ayres and Braithwaite Reference Ayres and Braithwaite1992; Bardach and Kagan Reference Bardach and Kagan2002; Braithwaite Reference Braithwaite2002; Kagan Reference Kagan2009). This stringent application of rules and regulations without regard to the compliance history of the regulated entity, they argued, was not only inefficient but created a backlash or resistance among well-intentioned regulated entities. As a result, such formalistic and adversarial regulation was ultimately less effective than a more cooperative approach. Nonetheless, some entities and individuals are likely to remain bad actors under any regulatory regime. Accordingly, more coercive regulatory approaches remain necessary, but only for a subset of organizations that prove unresponsive to more cooperative methods (Bardach and Kagan Reference Bardach and Kagan2002; Ayres and Braithwaite Reference Ayres and Braithwaite1992).
More recently, “new governance” scholars have extended these ideas to argue for a more robust role for regulated entities in their own compliance. Although there are a variety of new governance approaches that differ in their particulars, all share a common theme: given the vast variation in the stakeholder makeup, business environment, and other factors affecting business organizations, regulated entities are themselves often in the best position to define the most effective and efficient path to compliance with legal rules. As a result, new governance theorists reject “command and control” regulation in favor of more flexible, open-ended legal rules that leave discretion to regulated entities about how to comply with legal mandates (Lobel Reference Lobel2004; Trubek and Trubek Reference Trubek and Trubek2005; Holley, Gunningham, and Shearing Reference Holley, Gunningham and Shearing2013).
These ideas have enjoyed broad support among researchers across disciplines and are now reflected in legal regimes across nearly every subject matter area (Langevoort Reference Langevoort2017). Nonetheless, skeptics remain. First, as an empirical matter, some new governance devices have failed to withstand empirical scrutiny (Dobbin, Schrage, and Kalev Reference Dobbin, Schrage and Kalev2015; Gunningham and Sinclair Reference Gunningham and Sinclair2017). In addition, some worry that new governance advocates underestimate the possibility of strategic behavior by regulated entities, as well as the information asymmetries and other factors that may prevent courts and regulators from controlling that strategic behavior (Laufer and Strudler Reference Laufer and Strudler2007; Krawiec Reference Krawiec2009). Finally, the effectiveness of new governance regimes appears highly context dependent and determined by a number of factors, including the specific set of incentives and penalties provided by the government, the nature of the problem the regulation is designed to address, the specific characteristics of the regulated firms, and other factors (Coglianese and Nash Reference Coglianese, Nash, Coglianese and Nash2006).
One long-standing new governance skeptic is Lauren Edelman, whose Working Law synthesizes and extends a lifetime of research on compliance in the area of employment law (Edelman, Uggen, and Erlanger Reference Edelman, Uggen and Erlanger1999; Edelman Reference Edelman2016). Edelman questions the extent to which organizations can effectively self-regulate, arguing that law is often endogenous and reflects management interests. According to Edelman:
[O]rganizations respond to ambiguous law by creating a variety of policies and programs designed to symbolize attention to law. As these policies and programs become commonplace … legal actors, as well as organizational actors, understand compliance in terms of the presence or absence of these structures and thus fail to scrutinize their effectiveness. (Edelman Reference Edelman2016, 12)
The result can be what might be termed symbolic, or cosmetic, compliance that signals conformity with legal mandates without adequately addressing the underlying behavior that prompted regulation to begin with (Krawiec Reference Krawiec2003). Edelman suggests that an important reason for the limited success of employment and antidiscrimination law in reducing some forms of workplace bias and inequality is judicial and, to a lesser extent, EEOC deference to organizations’ symbolic structures, even when those structures are ineffective. Of particular concern to Edelman are antiharassment and antidiscrimination policies, grievance procedures, and diversity programs, all of which are widely present in most organizations (Edelman Reference Edelman2016).
NEW GOVERNANCE AND FINANCIAL REGULATION
These new governance debates have played a surprisingly minor role in financial regulation circles, considering the ubiquity of new governance (and, particularly, internal compliance and disclosure-based) regulation in that field. As just one example, the Securities Act of 1933, the expansive federal statute that regulates the public offering of securities, rejects government review of the substantive merits of investments in favor of a disclosure-based regime (Securities Act of 1933). For this reason, the 1933 Act is often referred to as the “truth in securities” law (U.S. Securities and Exchange Commission 2013). The most controversial provision of the Sarbanes-Oxley Act of 2002, section 404, provides another example. Section 404 requires officers of all reporting companies to disclose “material weaknesses” in their firm’s internal control system and requires that outside auditors attest to those disclosures. These requirements have significantly increased firms’ costs of internal controls (Sarbanes-Oxley Act 2002 §404; Coates Reference Coates2007).
This is not to suggest that financial regulation scholars ignore internal compliance. To the contrary, numerous articles discuss the technical aspects of financial institution internal compliance, including what the law requires, what constitute industry best practices and new developments, and specific cases of compliance failures (Murphy Reference Murphy2011; Simons Reference Simons2013). In addition, some scholars of financial regulation, most notably Donald Langevoort, have made important contributions in the compliance area, drawing from a variety of disciplines, including psychology, sociology, and economics (Langevoort Reference Langevoort2017; Langevoort Reference Langevoort and Arlen2018). Finally, scholars of white-collar crime have engaged with and contributed to the empirical literature on internal compliance (Arlen Reference Arlen2012; Hess Reference Hess2016). But with some exceptions (Black Reference Black1997; Ford Reference Ford2008; Riles Reference Riles2011), these debates have largely paralleled, rather than directly engaged—or been directly engaged by—the most prominent new governance scholars.
Nonetheless, financial regulation may be a particularly ripe area for the type of legal endogeneity documented by Edelman in the employment context. Specifically, three important factors identified by Edelman as contributing to legal endogeneity and symbolic compliance are particularly relevant in the context of financial regulation—legal ambiguity, a lack of outcome measures, and the presence of legal intermediaries (Edelman Reference Edelman2016).
THE PROBLEM WITH AMBIGUITY
Working Law seeks to offer a comprehensive theory of the symbiotic relationship between law and organizations by specifying the mechanisms through which law becomes endogenous. The ambiguity of law plays an important part in this theory. According to Edelman, primarily for political reasons, “social reform laws tend to be ambiguous and legal ambiguity leaves organizations wide latitude to construct the meaning of law and compliance with law” (Edelman Reference Edelman2016, 14).
Financial regulation is also often characterized as notably ambiguous. In thinking about why this might be so, it is worth recalling some of the most common sources of intentional legal ambiguity. As noted by Edelman, ambiguous law may occur for political reasons, as when lawmakers are unable to agree on more precise language, but can muster consensus on broad outlines. Relatedly, ambiguous language may facilitate strategic lawmaking that attempts to hide specific interest group transfers (Epstein and O’Halloran Reference Epstein and O’Halloran1999). Ambiguous law may also provide the flexibility to adapt to changing circumstances or allow inexpert lawmakers to delegate to expert administrative agencies the ability to more precisely define the scope of legal obligations (Baker and Krawiec Reference Baker and Krawiec2003).
The political stakes of financial regulation are often high, with a variety of well-funded and politically astute actors (including lawyers, financial institutions, issuers, and large investors) having a stake in the outcome. These conditions are ripe for political and strategic legal ambiguity, as suggested by reviews of the legislative history surrounding major pieces of financial reform (Grundfest and Pritchard Reference Grundfest and Pritchard2002; Krawiec Reference Krawiec2013).
In addition, modern financial markets and products are extraordinarily complex and ever-changing, as are the laws and regulations that seek to govern them. It is thus frequently argued that, due to the complexity, importance, and dynamic nature of financial markets, financial regulation must be more open ended and less rigid (Black Reference Baxter2008; Baxter Reference Baxter2016; Claessens and Kodres Reference Claessens, Kodres, Balleisen, Bennear, Krawiec and Wiener2017).Footnote 1
A few examples will help illustrate these points. The Private Securities Litigation Reform Act (PSLRA), part of a more general plan of Republican tort reform, arose in response to concerns over frivolous securities fraud suits. The Act strengthens pleading requirements by forcing plaintiffs in securities fraud actions to “state with particularity the facts giving rise to a strong inference that the defendant acted with the requisite state of mind” (PSLRA 1995). The statute, however, does not define either the “requisite state of mind” or the types of facts that would give “rise to a strong inference” that the defendant acted with that state of mind. This is despite congressional awareness that these terms were politically contested, with two important interest groups—trial lawyers and securities issuers—taking opposing sides on the issue. Moreover, as Congress was aware, these terms had been given inconsistent and conflicting interpretations by federal courts for many years prior to PSLRA passage (Baker and Krawiec Reference Baker and Krawiec2003). Importantly, an analysis of the PSLRA’s legislative history by Grundfest and Pritchard (Reference Grundfest and Pritchard2002) suggests that this ambiguity was necessary to garner the supermajority of votes necessary to pass the PSLRA over President Clinton’s veto.Footnote 2 This ambiguity plagued courts for many years after PSLRA passage and, indeed, continues to do so.
The Dodd-Frank Act, the most sweeping piece of financial reform in generations, also provides a good example of purposely open-ended legislation. The statute’s ambiguous nature has been noted by nearly every commentator—popular, practitioner, and academic—to consider it (Appelbaum Reference Appelbaum2010; Davis Polk & Wardwell LLP 2010; Wilmarth Reference Wilmarth2010). Some of those ambiguities would be resolved during the regulatory process. Others, however, would not. An analysis of the statute’s legislative history suggests that both political disagreements and the complexity of the subject matter contributed to a notoriously vague statute (Krawiec Reference Krawiec2013).
Finally, operational risk—the risk of loss from “inadequate or failed internal processes, people and systems or from external events”—under the Basel II Capital Accord provides a good example of ambiguity stemming from issue complexity and the desire to provide flexibility and encourage innovation.Footnote 3 Although the Basel II Accord requires banks to protect against operational risk by holding capital specifically allocated for that purpose, it does not mandate how banks should measure that risk, instead allowing banks to choose their own methodology for assessing operational risk. According to the Basel Committee, this approach was necessary because operational risk measurement and management techniques were still relatively crude and underdeveloped (Basel Committee on Banking Supervision 2002, 7).
Recognizing this challenge, the Committee allowed financial institutions meeting certain criteria to use their own risk metrics in calculating the operational risk capital requirement. As discussed below, this has led to a number of problems in operational risk regulation and calls to abandon or substantially revise the Basel II operational risk framework.
In sum, Edelman argues that legal ambiguity is conducive to legal endogeneity, and there is no shortage of that ambiguity in financial regulation. Instead, the high stakes, political disagreements, powerful interest groups, difficult subject matter, and quickly changing nature of financial markets and products ensure some level of ambiguity—often, pervasive ambiguity—even (or, perhaps, particularly) in the most important pieces of legislation.
LACK OF OUTCOME MEASURES
Ambiguous laws need not lead to legal endogeneity and cosmetic compliance, however. When courts and regulators apply clear outcome measures to determine compliance with the law, there is less room for managerial interpretations to take hold (Edelman Reference Edelman2016).
Many substantive areas of law naturally lend themselves to outcome measures of this type. Food and drug safety, as well as environmental regulations that depend on emissions limits or effluent levels are common examples (Magat and Viscusi Reference Magat and Viscusi1990; U.S. Food & Drug Administration 2017). But financial regulation often is not susceptible to these types of outcome measures. To be sure, outcome measures are not wholly absent from financial regulation—stress tests, capital requirements, and some risk limits strive for objective criteria to determine compliance. But this is not representative of most financial regulation, which, by necessity, must rely on policies, programs, and procedures to judge compliance. And even objective outcome tests in the financial arena frequently rely on data, information, or algorithms supplied by the regulated entity itself. Indeed, a number of high-profile cases of massive financial institution losses (such as the United Kingdom’s Barings Bank and France’s Société Générale, among others) involved the falsifying of data and records provided to financial institution management and/or regulators (Krawiec Reference Krawiec2009). The result is that, too often, the effectiveness of any given financial regulation will be unknown until it becomes clear that it has failed, as was the case in the 2008 global financial crisis (Claessens and Kodres Reference Claessens, Kodres, Balleisen, Bennear, Krawiec and Wiener2017).
Returning to the example of operational risk under Basel II, recall that large banks are permitted to rely on internally generated data, models, and methodologies in determining the proper capital set-aside. As stated by the Basel Committee:
Under the [AMA], banks will be permitted to choose their own methodology for assessing operational risk …. The extent of detailed standards and criteria for use of the AMA are minimal in an effort to spur the development of innovative approaches. (Basel Committee on Banking Supervision, 2002, 7–8)
For a variety of reasons, however, this self-regulatory approach has been ill-suited to operational risk, as exemplified by a variety of high-profile operational losses in the United States and abroad, including the largest rogue trading loss in history—over $7 billion by Jerome Kerviel of the French Bank, Société Générale (Krawiec Reference Krawiec2009; Sands, Liao, and Ma Reference Sands, Liao and Ma2018). Systematic reviews also indicate great variability in the manner by which different institutions account for operational risk and a lack of comparability across institutions, making oversight difficult (Sands, Liao, and Ma Reference Sands, Liao and Ma2018). In the case of rogue traders, in particular, oversight efforts have been thwarted by a falsifying of the data and records used to perform oversight functions (Krawiec Reference Krawiec2009). Critics also have argued that operational risk standards are subjective and prone to gaming by financial institutions, and that banks may spend large sums on operational risk compliance, without addressing material risks (Moosa Reference Moosa2008). These problems have resulted in numerous calls to alter the current approach to operational risk regulation.
LEGAL INTERMEDIARIES AND LEGAL DEFERENCE
In the final step of legal endogeneity, various actors (which I refer to in prior work as “legal intermediaries”) both outside and within the regulated entity are left to interpret and implement ambiguous law and are likely to do so in a manner that advances their own interests. As a result, the meaning of law tends to be heavily influenced by the very entities and individuals it is meant to control (Edelman Reference Edelman2016).
The financial industry has a wealth of legal intermediaries with a credible claim of expertise in interpreting and implementing ambiguous law, including lawyers and consultants, compliance officers, accountants (with a claim of expertise in internal controls), and risk management experts (with a claim of expertise in risk measurement and modeling). Each of these legal intermediaries has an incentive to emphasize—or overemphasize—both the extent of legal risk and their ability to contain it. Meanwhile, senior management of regulated financial institutions has an incentive to signal compliance with the new legal rules, while containing costs and disrupting existing business practices as little as possible (Krawiec Reference Krawiec2009).
As Edelman notes, courts and regulatory agencies theoretically retain the power to reject these programs, policies, and procedures as insufficient compliance with legal obligations. But legal actors (and courts, in particular) have limited time, expertise, and incentives to differentiate self-serving or inefficient interpretations from those that show a genuine commitment to legal ideals. And once particular policies, programs, and practices have gained legitimacy as “best practices” among the regulated group, it is tempting for courts and regulatory bodies to measure compliance with the law against the industry standard, with limited inquiry into the role played by the regulated group and other self-interested actors in establishing those standards or, as documented by Edelman, into the effectiveness of these mechanisms in deterring prohibited conduct.
Returning a final time to operational risk will help illustrate this point. As previously noted, the Basel II requirements prompted a new focus on and importance of operational risk management. Experts rushed to fill the ensuing void, creating an operational risk management industry where none had previously existed (Power Reference Power2006). In fact, the very lack of an existing consensus on modeling, measurement, and control increased the scope for competing and entrepreneurial solutions that catered to specific groups’ expertise. Accountants, for example, sought to define operational risk as unsusceptible to quantification and, therefore, primarily addressable through internal controls. Lawyers sought to define operational risk primarily in compliance and organizational governance terms. Risk management experts, trained in financial economics and possessing quantitative and modeling skills and training, packaged operational risk as amenable to measuring, modeling, and testing. As a result, operational risk management is today a briskly growing multi-billion-dollar industry (Krawiec Reference Krawiec2009).
CONCLUSION
Lauren Edelman’s Working Law is remarkably relevant to the study of financial regulation. In particular, three factors that Edelman identifies as specifically contributing to legal endogeneity and symbolic compliance—ambiguous law, a lack of clear outcome measures, and the presence of legal intermediaries—are especially salient in the context of financial regulation.
Financial regulation is complicated and frequently opaque, as is the behavior it is meant to control. Often, the general public, courts, and lawmakers have only a limited understanding of the regulated behavior. Although financial regulators are generally presumed to possess more expertise, they nonetheless operate at an informational disadvantage relative to regulated entities and, moreover, suffer from limited time, constrained budgets, and political pressures.
Finally, many of the benefits of financial regulation—reduced systemic risk and increased financial stability and liquidity—are widely dispersed, while the costs are borne by an increasingly concentrated financial industry. Those institutions (along with their lobbyists, lawyers, consultants, and other advisors) have not only the incentive, but also the power and resources, to shape the law to their benefit. It has long been recognized that this occurs ex ante, through political lobbying. Edelman’s work reinforces the point that it may also happen ex post through an endogenous process of interpretation, implementation, and, ultimately, enshrinement of symbolic compliance with ambiguous law.
