The VW "defeat devices" story that broke this week is
(another) reminder of how badly wrong things can go for businesses
that do not effectively map and manage their regulatory
risks. There can often be a "practicality
disconnect" between business executives understanding the
regulatory framework within which they operate (for example,
engineers and compliance managers understanding in detail the
environmental, health and safety, data management, antitrust,
chemical/food/biotech/medical device, etc. rules with which they
must comply) and what they must do on a day-to-day basis to
mitigate the risks of a material breach of those rules
occurring.
In seeking to understand what to do, it is helpful to consider
why things go wrong: why did VW (or certain executives at VW) fit
the "defeat devices" into millions of vehicles and think
they could get away with it? There are usually three reasons why
such failures occur:
