Regulators in a number of countries are increasingly developing "risk-based" strategies to manage their resources, and their reputations as "risk-based regulators" have become much lauded by regulatory reformers. This widespread endorsement of risk-based regulation, together with the experience of regulatory failure, prompts us to consider how risk-based regulators can attune the logics of risk analyses to the complex problems and the dynamics of regulation in practice. We argue, first, that regulators have to regulate in a way that is responsive to five elements: (1) regulated firms' behavior, attitude, and culture; (2) regulation's institutional environments; (3) interactions of regulatory controls; (4) regulatory performance; and (5) change. Secondly, we argue that the challenges of regulation to which regulators have to respond vary across the different regulatory tasks of detection, response development, enforcement, assessment, and modification. Using the "really responsive" framework, we highlight some of the strengths and limitations of using risk-based regulation to manage risk and uncertainty within the constraints that flow from practical circumstances and, indeed, from the framework of risk-based regulation itself. The need for a revised, more nuanced conception of risk-based regulation is stressed.
