Citations (6)


Footnotes (361)



Technologies of Compliance: Risk and Regulation in a Digital Age

Kenneth A. Bamberger

University of California, Berkeley - School of Law

Texas Law Review, Vol. 88, p. 669, 2010
UC Berkeley Public Law Research Paper No. 1463727

Legal scholarship has been silent about a phenomenon with profound implications for governance: the automation of compliance with laws mandating risk management. Regulations - from bank capitalization rules, to Sarbanes-Oxley’s provisions on financial fraud and misrepresentation, to laws governing information-privacy protection - frequently require regulated firms to develop internal processes to identify, assess, and mitigate risk. To comply, firms have turned wholesale to technology systems and computational analytics that measure and predict corporate risk levels and “force” decisions accordingly. In total, the third-party market for compliance-technology products - known generally as “governance, risk, and compliance” (GRC) software, systems, and services - alone grew to $52 billion last year, and this growth is poised to increase exponentially.

While these technology systems offer powerful compliance tools, they also pose real perils. They permit computer programmers to interpret legal requirements; they mask the uncertainty of the very hazards with which policy makers are concerned; they skew decision making through an “automation bias” that privileges personal self-interest over sound judgment; and their lack of transparency thwarts oversight and accountability. These phenomena played a critical role in the recent financial crisis.

This Article explores these developments and the failure of risk regulation to address them. While regulators have lauded the turn to technology, they have ignored its perils. By contrast, the Article investigates the accountability challenges posed by these and other technologies of control, and suggests specific reform measures for policy makers revisiting the governance of risk. It argues for more activist regulator oversight backed by sanctions before disaster has occurred. But it also emphasizes collaboration in developing risk-management systems, drawing both on the granular expertise of firms and the broader vantage of administrative agencies. Most importantly, it seeks better to reflect the human decision-making element at both levels: to recognize the ways in which technology can hinder good judgment, to reintroduce human inputs in the decision process, and to reflect the limits of both human and computer reasoning.

Number of Pages in PDF File: 71

Keywords: Technology, Compliance, Automation, Administrative Agencies, Regulation, New Governance, Risk Management, Accountability, Judgment, Automation Bias, Organizational Decisionmaking, Financial Services Regulation

JEL Classification: G28, G38, K22, K23, K42, M14, O33

Open PDF in Browser Download This Paper

Date posted: August 29, 2009 ; Last revised: February 28, 2014

Suggested Citation

Bamberger, Kenneth A., Technologies of Compliance: Risk and Regulation in a Digital Age. Texas Law Review, Vol. 88, p. 669, 2010; UC Berkeley Public Law Research Paper No. 1463727. Available at SSRN: https://ssrn.com/abstract=1463727

Contact Information

Kenneth A. Bamberger (Contact Author)
University of California, Berkeley - School of Law ( email )
Boalt Hall NA446
Berkeley, CA 94720-7200
United States
(510) 643-6218 (Phone)
HOME PAGE: http://www.law.berkeley.edu/faculty/profiles/facultyProfile.php?facID=5701

Feedback to SSRN

Paper statistics
Abstract Views: 4,471
Downloads: 830
Download Rank: 21,354
Citations:  6
Footnotes:  361