The Red Cross Ledger

A modern regulator’s approach to targeting priority risks and directing investigative effort where it matters most

The purpose of this article is to provide regulators with a clear, contemporary blueprint for strengthening their investigative capability in an increasingly complex operating environment.

It demonstrates how a data‑led, intelligence‑driven, risk‑based approach enables regulators to direct effort where it has the greatest impact, respond proportionately to emerging risks, and build a more resilient regulatory system. By integrating insights on risk appetite, behavioural drivers, intelligence practice, and investigative prioritisation, the article equips regulatory leaders and practitioners with a practical, future‑focused model for improving compliance outcomes, enhancing public trust, and preventing harm before it occurs.

Regulators today operate in environments defined by complexity, rapid change, and rising expectations. Industries are evolving, supply chains are globalising, and risks are becoming more interconnected. In this landscape, traditional investigation models, reactive, linear, and incident‑driven, no longer deliver the level of system performance and public confidence that regulators are expected to uphold.

Modern regulators are shifting toward a data‑led, intelligence‑driven, risk‑based approach. This approach ensures investigators focus their effort where it will have the greatest impact: on priority risks, high‑risk entities, and systemic contributors to harm or non‑compliance.

This article outlines how regulators can optimise their investigative capability using contemporary compliance principles, intelligence frameworks, and structured targeting methodologies, supported by a realistic, regulator‑neutral case study that I have undertaken in the past. For the purposes of the article, I have removed identifiers and used generalised depictions.

1. Begin With Priority Risks, Not Just Reports or Complaints

Regulators receive large volumes of reports, notifications, and concerns each year. But not all issues carry the same risk, and not all investigations deliver the same value.

A modern regulator begins with priority risks, identified through:

• Historical, current, and emerging risk analysis
• Data‑driven trend identification
• Intelligence assessments
• Behavioural insights
• Systemic vulnerabilities
• Geographic or sector‑specific patterns

This aligns with best‑practice compliance principles:

• Voluntary compliance first
• Risk‑based targeting
• Intelligence‑led decision‑making
• Proportionate and consistent responses
• Outcome‑focused regulatory effort

Instead of responding to every matter in the same way, the regulator defines intelligence requirements:

• Where are the most serious risks emerging
• Which entities or sectors show concerning patterns
• What systemic factors are driving repeated issues
• Where investigators can intervene to prevent future harm

This ensures investigative resources are directed toward risk, not noise.

Case Study: Priority Risk – Repeated System Failures in a Logistics Network

A regulator receives a report of a serious operational failure at a large logistics hub. Under a traditional model, the regulator would investigate the incident, issue findings, and close the file.

But under a priority‑risk, intelligence‑driven model, the regulator takes a broader, system‑level view.

Step 1: Define the Intelligence Requirement

“What systemic factors are contributing to repeated operational failures across the logistics sector, and which entities present the highest emerging risk?”

This shifts the focus from one incident to sector‑wide risk prevention.

Step 2: Build a Collection Plan

Analysts draw from:

• Multi‑year incident and failure reports
• Previous enforcement actions
• Audit and compliance history
• Supply‑chain and subcontractor data
• Community reports and concerns
• Open‑source information
• Cross‑agency intelligence

Step 3: Analysis Identifies a Priority Risk Pattern

The intelligence team uncovers:

• A 29% rise in operational failures in the past 18 months
• A cluster of incidents in regional distribution hubs
• A strong correlation between subcontractor turnover and system breakdowns
• Multiple entities with repeated non‑compliance in control measures
• Seasonal spikes linked to peak demand periods

The incident is no longer an isolated event; it is a symptom of a systemic priority risk.

Step 4: Intelligence‑Led Investigator Activity

The regulator launches a coordinated response:

• A targeted inspection and investigation program across 20 high‑risk hubs
• A sector‑wide advisory notice
• Updated guidance on system controls and governance
• A focus on training, competency, and assurance
• A follow‑up intelligence product to monitor intervention effectiveness

Outcome

Within 12 months:

• Serious incidents drop by 17%
• High‑risk entities demonstrate measurable improvement in system controls
• Industry adopts stronger governance and assurance practices
• Investigators focus their effort where harm is most likely to occur

This is the power of intelligence‑driven regulatory investigations.

Organisational and Executive Risk Appetite: Setting the Boundaries for Regulatory Action

A regulator’s ability to operate effectively in a data‑led, intelligence‑driven, risk‑based environment depends heavily on the organisation’s risk appetite, the level of risk the executive is willing to tolerate in pursuit of regulatory outcomes. Risk appetite is not a theoretical statement; it is a practical boundary that shapes:

• How investigations are prioritised
• How resources are allocated
• How assertively the regulator intervenes
• How quickly emerging risks trigger action
• How much uncertainty the organisation is prepared to accept

A clear, well‑articulated risk appetite ensures investigators and intelligence teams operate with confidence, consistency, and alignment to organisational priorities.

1. Risk Appetite Defines What “Good” Looks Like

Without a defined risk appetite, investigators may default to:

• Over‑enforcement (risk‑averse behaviour)
• Under‑enforcement (risk‑tolerant behaviour)
• Inconsistent decision‑making
• Reactive rather than strategic action

A mature regulator sets explicit expectations about:

• Which risks are unacceptable
• Which risks can be tolerated temporarily
• Which risks require immediate escalation
• Which risks can be managed through education or voluntary compliance

2. Executive Risk Appetite Shapes Targeting and Prioritisation

A regulator with a low tolerance for systemic or high‑impact risks will:

• Prioritise investigations into repeated or deliberate non‑compliance
• Allocate resources to high‑risk entities or behaviours
• Expect rapid escalation when early indicators of harm appear
• Support assertive enforcement action when necessary

A regulator with a higher tolerance for lower‑impact risks may:

• Focus on education and voluntary compliance
• Accept slower remediation for minor issues
• Direct investigators toward long‑term systemic risks rather than isolated events

3. Risk Appetite Must Be Informed by Intelligence

Risk appetite evolves as intelligence reveals:

• Emerging threats
• Shifts in industry behaviour
• New patterns of non‑compliance
• Systemic vulnerabilities
• Geographic or demographic changes
• Human‑factor drivers of behaviour

4. Risk Appetite Enables Proportionate and Defensible Enforcement

Risk appetite provides the framework for determining when to:

• Inform
• Assist
• Direct
• Enforce

It ensures that investigators apply regulatory levers in a way that is predictable, fair, and aligned with organisational expectations.

5. Risk Appetite Supports Organisational Courage

A clearly articulated risk appetite:

• Gives investigators permission to act decisively
• Reduces hesitation caused by uncertainty
• Encourages early intervention when intelligence indicates emerging harm
• Supports escalation when non‑compliance is deliberate or systemic

6. Risk Appetite Must Be Communicated, Embedded, and Reviewed

A risk appetite statement is only effective when:

• Executives communicate it clearly
• Investigators understand how it applies
• Intelligence teams use it to shape targeting
• It is reviewed regularly as the environment evolves

Building the Foundations of an Intelligence‑Led Regulatory System

2. Build a Data Spine That Supports Investigator Decision‑Making

A regulator’s data capability underpins its intelligence‑led, risk‑based approach. A modern investigative function requires:

• A single source of truth for reports, audits, complaints, and enforcement history
• Standardised taxonomies (risk categories, incident types, behavioural drivers)
• Automated ingestion of internal and external data
• Geographic heat‑mapping and trend analysis
• Strong governance around privacy, security, and classification

Data is the foundation and intelligence is the value.

3. Integrate Analysts into the Investigative Lifecycle

Investigators bring technical and operational expertise. Analysts bring pattern recognition, structured analysis, and foresight. Together, they create a powerful capability.

Analysts support investigations by:

• Conducting trend and pattern analysis
• Testing hypotheses
• Mapping linkages across entities, contractors, and supply chains
• Identifying systemic drivers of non‑compliance
• Applying structured analytical techniques

This reduces bias, strengthens findings, and ensures investigations contribute to system‑level improvement.

4. Adopt the Intelligence Cycle as the Investigative Cycle

The intelligence cycle, tasking, collection, analysis, dissemination, evaluation, is a natural fit for regulatory investigations.

Applied to a regulator, it becomes:

• Tasking: Define the investigative purpose and risk context
• Collection: Gather information using structured plans
• Analysis: Interpret information using structured techniques
• Production: Develop clear, timely, risk‑focused findings
• Dissemination: Share insights across the organisation
• Evaluation: Assess whether the investigation reduced risk

This creates a repeatable, defensible, high‑quality investigative practice.

5. Understand Behavioural Drivers of Non‑Compliance

Drawing from human‑factors and regulatory‑behaviour research, non‑compliance is often driven by:

• Commercial pressures
• Knowledge gaps
• Normalisation of deviance
• Misaligned risk perceptions
• Geographic and operational constraints
• Poor governance or oversight
• Inadequate training or competency
• Weak scheme‑management controls

Investigations that consider behavioural drivers produce more accurate findings and more effective interventions.

6. Build Capability and Maturity, Not Just Process

A regulator’s intelligence maturity grows through:

• Professional training for investigators and analysts
• Clear standards, templates, and methodologies
• Strong governance and oversight
• Continuous improvement loops
• A culture that values intelligence, not just evidence

This is how a regulator becomes truly intelligence‑led.

Final Reflection

The case study demonstrates a simple truth: Investigations are most powerful when they are intelligence‑led, data‑driven, and risk‑based. A single incident becomes the catalyst for sector‑wide improvement. An isolated event becomes a systemic insight. A reactive investigation becomes proactive stewardship. This is the future of modern regulation, and the path to stronger, safer, more resilient systems.

Regulators today stand at a crossroads. The complexity of modern industries, the speed of technological change, and the expectations of communities’ demand more than traditional, reactive investigation models. They demand regulators who can see patterns before they become crises, who can intervene early, and who can direct their investigative effort with precision and purpose.

A data‑led, intelligence‑driven, risk‑based approach is not simply an operational preference, it is the foundation of credible, contemporary regulation. It transforms investigations from isolated events into strategic levers that shape industry behaviour, strengthen system integrity, and prevent harm before it occurs. It empowers investigators to act with confidence, guided by clear risk appetite boundaries and supported by robust intelligence, behavioural insight, and organisational courage.

When regulators embrace this model, they shift from chasing non‑compliance to anticipating it. They move from reacting to incidents to shaping safer, more resilient systems. And they demonstrate to industry, government, and the public that regulatory power is not measured by the volume of enforcement, but by the quality of insight, the clarity of purpose, and the impact of well‑directed action.

The future of regulation belongs to those who can integrate intelligence, data, risk, and human behaviour into a single, coherent operating model. Those who can do this will not only respond to harm, but they will also prevent it. They will not only enforce compliance, but they will also elevate it. And they will not only protect the system, but they will also strengthen it for the generations that follow.