In-House Regulators: Documenting the Impact of Regulation on Internal Firm Structure

In a deregulatory environment, what do regulated firms do? The standard assumption is simple: firms revert to their pre-regulatory form. This Essay challenges that basic assumption. Increasingly, regulation is conducted through broad standards foisted on firms to implement internally. Congress articulates a policy goal; agencies enact specific standards for regulated entities; and firms are left to sort out how to comply with such standards. Recent mandates in financial, privacy, and medical regulation exemplify this approach. Despite these changes, scholars have not turned their attention to how this new form of regulation changes the structure of the regulated entity. Using case studies and theoretical insights, this Essay hypothesizes that the structures firms create in a regulated environment will not immediately disappear in a deregulatory world. Rather, they will persist. Modern regulation causes firms to make department-specific investments and centralize information gathering. Firms accomplish this, in part, by increasing the presence of regulatory-related staff. And, once these investments are completed, they will insulate regulatory-related staff from immediate removal in a deregulatory environment. That is, in-house regulators will be sticky. This Essay aims to provide an array of theories to support this phenomenon.

Introduction

Deregulation is an integral part of President Trump’s agenda.¹1.See Reducing Regulation and Controlling Regulatory Costs, Exec. Order No. 13,771, 82 Fed. Reg. 9,339 (Feb. 3, 2017); Core Principles for Regulating the United States Financial System, Exec. Order No. 13,772, 82 Fed. Reg. 9,965 (Feb. 8, 2017). Scholars have been quick to point out that there are multiple headwinds to his deregulatory agenda. The Senate stymied efforts to repeal and replace the Affordable Care Act, for instance.²2.Erica Werner & Alan Fram, GOP Dealt Stiff Blow in Senate’s Bid to Repeal ‘Obamacare,’ Associated Press (July 28, 2017), http://apnews.com/a3286ef6fca74cac93fac360ad76f3d4 (https://perma.cc/SHR5-QZBG).

Congressional repeal is not Trump’s only option—regulatory changes have focused on agency process. But scholars are also quick to point out that deregulation faces both legal and practical hurdles. In the legal realm, the repeal of rulemaking must go through the standard notice-and-comment process,³3.5 U.S.C. §§ 551(5), 553 (2012). and can be challenged as arbitrary and capricious.⁴4.See, e.g., Motor Vehicles Mfrs. Ass’n of United States v. State Farm Mut. Auto. Ins., 463 U.S. 29 (1983); see also Jonathan S. Masur & Eric Posner, Cost-Benefit Analysis and the Judicial Role, 85 U. Chi. L. Rev. (forthcoming 2018) (discussing the “arbitrary and capricious” standard applied by courts); Daniel Hemel, Jonathan Masur & Eric Posner, How Antonin Scalia’s Ghost Could Block Donald Trump’s Wall, N.Y. Times (Jan. 25, 2017), http://www.nytimes.com/2017/01/25/opinion/how-antonin-scalias-ghost-could-block-donald-trumps-wall.html (https://perma.cc/3UMN-DTF3). On the more practical side, deregulation requires the cooperation of a vast bureaucracy consisting of agency employees with their own incentives.⁵5.See Jennifer Nou, Taming the Shallow State, 36 Yale J. on Reg.: Notice & Comment (Feb. 28, 2017), http://yalejreg.com/nc/taming-the-shallow-state-by-jennifer-nou (https://perma.cc/PT9C-JSYY).

These hurdles are significant, and I do not dispute them here. However, this Essay’s aim is to recognize regulation’s impact on how firms are organized and suggest that regulation changes firm structure and that this change may persist, albeit mildly, in a deregulatory state. This Essay’s hypothesis is simple: regulation creates extragovernmental hurdles to deregulation by changing how firms are organized.

New regulation brings about observable changes to firms. In areas such as finance, privacy, and medicine, regulation is now accomplished through broad standards that firms must implement themselves. ⁶6.“With the passage of HIPAA, Congress set in motion the development of specific security and privacy guidelines for the healthcare domain through standards-based regulation.” Paul N. Otto, Reasonableness Meets Requirements: Regulating Security and Privacy in Software, 59 Duke L.J. 309, 324 n.74, 325, (2009) (“There are several examples of other recent laws and regulations that adopt a standards-based approach to regulating security and privacy in software.”). This regulation through delegation requires regulated firms to gain regulatory expertise. To do this, firms hire experts—they invest in processes that will allow them to comply with inherently opaque regulatory pronouncements.

The increased hordes of in-house regulators will “not go gentl[y] into that good night.” ⁷7.The Collected Poems of Dylan Thomas, 1934–1952, at 128 (New Directions 1971). In fact, they may “(r)age, rage against the dying of the light.” Id. That is, they will attempt to fortify their influence within the firm regardless of deregulation. Within the administrative state, this fortification is not surprising, and administrative law scholars have studied it extensively.⁸8.See generally Nina A. Mendelson, Agency Burrowing: Entrenching Policies and Personnel Before a New President Arrives, 78 N.Y.U. L. Rev. 557 (2003). But their focus has generally been inward, looking at administrative agencies and their agents.⁹9.Kenneth A. Bamberger, Regulation as Delegation: Private Firms, Decisionmaking, and Accountability in the Administrative State, 56 Duke L.J. 377, 381 (2006) (“In general, however, administrative law’s sophisticated vision of organizational decisionmaking ends at the doors of the regulated firm.”). This Essay looks outward, at the agents within regulated entities tasked with regulatory implementation. These in-house regulators have their own incentives and want to keep their jobs even in a deregulatory environment. How they go about accomplishing that has not been systematically documented or studied.

The aim of this Essay, then, is both positive and theoretical. Administrative law is inwardly focused, with scholars turning their lens toward either controls on the administrative state or the structure of the administrative state.¹⁰10.Similarly, business law scholars have, for the most part, presumed that deregulation causes firms to revert back to their pre-regulatory form. See Timothy F. Malloy, Regulating by Incentives: Myths, Models, and Micromarkets, 80 Tex. L. Rev. 531, 533 (2002) (“(A)ssum(ing) that the organization is a monolithic entity that essentially makes decisions as a natural individual would . . . (mean) the collective nature of the firm and its internal features are largely ignored.”). Often overlooked in this literature is the impact of regulation on the regulated entities.¹¹11.While recent scholarship has started to think about regulated entities, its focus remains on how administrative law or process changes incentives for firms, but does not address how those incentives work to actually change the structure and operations of the regulated entities. See, e.g., James W. Coleman, Policymaking by Proposal: How Agencies Are Transforming Industry Investment Long Before Rules Can Be Tested in Court, 24 Geo. Mason L. Rev 497 (2017) (documenting how, in regulated-rate industries such as power generation, regulators write excessively burdensome proposed rules that incentivize investment by increasing the certainty of regulation, even if the final rule is less burdensome than originally proposed); Aaron Nielson, Sticky Regulations, 85 U. Chi. L. Rev 85 (2018) (asserting that ossification creates incentives for firms to invest because it provides certainty that the rule will remain on the books for a prolonged period of time). Even the scholarly debate surrounding cost-benefit analysis tends to be about its impact on agency discretion.¹²12.See, e.g., John C. Coates IV, Cost-Benefit Analysis of Financial Regulation: Case Studies and Implications, 124 Yale L.J. 882, 882, 887 (2015) (arguing that cost-benefit analysis of financial regulation would result in a “guesstimation” and proposing that expert judgment is central to financial regulation); Masur & Posner, supra note 4 (celebrating judicial review of cost-benefit analysis and noting that such a review constitutes a “decision procedure” that agencies are then required to comply with). Lacking so far in the literature is an account of how regulations impact the structure of regulated entities. To supplement the literature, this Essay first provides a brief overview of the modern regulatory state, documenting two phenomena: the tendency of the administrative state to reject deregulation or, at least, slow a deregulatory tide, and an increasingly standards-based or delegatory administrative state. After briefly highlighting the impact of regulation’s shift on firms, this Essay explores how changes in firm structure may insulate firm regulatory staff in a deregulatory environment.

I. Deregulation Inside the Administrative State: The Impediments Posed by Administrative Agencies

As others have observed, deregulation is not easy. Practical and legal impediments hinder deregulation’s speed¹³13.See Daniel Hemel, President Trump vs. the Bureaucratic State, Yale J. on Reg.: Notice & Comment (Feb. 18, 2016), http://yalejreg.com/nc/president-trump-vs-the-bureaucratic-state-by-daniel-hemel (https://perma.cc/BE56-R5DU) (observing that President Trump “might not have the bureaucratic buy-in necessary to carry those (deregulatory) policies through”). Before taking up deregulation’s effect on regulated entities, it is important to survey these hurdles. In part, these hurdles may explain this Essay’s hypothesis—if deregulation inside the administrative state proceeds at a lethargic pace, firms may respond accordingly.

Regardless, understanding regulatory effects on firms requires a basic understanding of two key features of the modern administrative state. First, the evolving nature of regulation—the shift from command-and-control regulatory schemes to more deregulatory schemes—changes how firms implement and respond to regulatory pressures. Second, in part due to this shift, the significance of practical hurdles to deregulation—such as ossification and burrowing—increases. And more complex, standards-based regulation necessarily places more discretion in bureaucrats whose policy preference may not align with the administration’s.

Bureaucracies can resist outside pressure (or political pressure from the top). To deregulate, agencies must show, via studies, fact-finding, and comments received, that the proposed rule (or proposed removal of a rule) is not a “clear error of judgment.” And “[t]he high costs associated with rule change lead[s] to ‘ossification’—a powerful status quo bias.”¹⁴14.Note, Judicial Review of Agency Change, 127 Harv. L. Rev. 2070, 2085 (2014). Burrowing serves to increase the costs of deregulation. By placing members of a former president’s staff in career positions within agencies, the view of agency staff aligns with the former, not the current, political order.¹⁵15.See generally Mendelson, supra note 8. But agency heads must rely on these staffers to conduct the laborious and methodical work required for deregulation to pass judicial muster. The problem for deregulation is obvious—the burrowed staffers will drag their feet on policies they dislike.

These theoretical insights, of course, are currently bumping up against a messy reality. Data suggest that “civil servants are bailing,” contrary to the burrowing hypothesis.¹⁶16.Jennifer Nou, Bureaucratic Exit and Loyalty Under Trump, Yale J. on Reg.: Notice & Comment (Jan. 9, 2018), http://yalejreg.com/nc/bureaucratic-exit-and-loyalty-under-trump (https://perma.cc/X3CV-6XKA). Political appointees’ requests for budget cuts may exacerbate this exodus.¹⁷17.See, e.g., Zeeshan Aleem, Trump Wants to Gut the State Department by 25 Percent. You Read That Right., Vox Media (Feb. 12, 2018, 6:50 PM EST), https://www.vox.com/policy-and-politics/2018/2/12/17004372/trump-budget-state-department-defense-cuts (https://perma.cc/T4U4-W6JJ). Nevertheless, an understanding of the current state of play in how the administrative state regulates and operates has implications for how firms respond. And an outline of current agency process will serve as a backdrop for an understanding of why regulated entities respond the way they do to regulation and deregulation. To that end, this Part first highlights the practical realities of agency administration in a deregulatory environment before documenting the evolving nature of regulation and discussing how the theoretical hurdles to deregulation work in a standards-based regulatory system.

A. Practical Challenges to the Deregulation Inside the Agency

1. Ossification

Changes to regulations must be “based on a consideration of the relevant factors,” and courts will want to see the agencies “examin[ing] the relevant data and articulat[ing] a satisfactory explanation for its action including a rational connection between the facts found and the choice made.”¹⁸18.State Farm, 463 U.S. at 42–43 (citation and internal quotation marks omitted). In practice, this standard increases the time and cost it takes to repeal or change regulation—it “requir[es] that agencies provide detailed explanations of their behavior, consider viable alternatives, explain departures from past practices, and make policy choices that are reasonable on the merits.”¹⁹19.Note, Rationalizing Hard Look Review After the Fact, 122 Harv. L. Rev. 1909, 1914 (2009). Currently, Trump has directed the heads of executive agencies to investigate deregulatory avenues.²⁰20.Core Principles for Regulating the United States Financial System, Exec. Order No. 13,772, 82 Fed. Reg. 9965 (Feb. 8, 2017). But, even where regulation can be identified and modified, the process of actually doing so will require executive agencies to show, via studies, fact-findings, and comments received, that the proposed rule is not a “clear error of judgment.”²¹21.State Farm, 463 U.S. at 43. The high costs associated with rule changes make the status quo sticky.²²22.Note, Judicial Review of Agency Change, supra note 16, at 2085.

Besides the issues raised by State Farm and arbitrary-and-capriciousness review, the cost of notice-and-comment rulemaking remains. “Rule making” as defined by the Administrative Procedure Act,²³23.5 U.S.C. § 500 et seq. (2012). includes “repealing a rule,” ²⁴24.5 U.S.C. § 551(5) (2012). and even informal rulemaking requires notice and comment.²⁵25.See 5 U.S.C. § 553 (2012). Rulemaking is not a painless process. For example, in April 2009, the GAO found that even simple rulemakings can take six months to complete, and that was on the lower end of estimates for agencies. Some agencies, like the FDA, estimated “that a straightforward rulemaking may take up to 3½ to nearly 4 years from initiation to final publication.”²⁶26.Federal Rulemaking: Improvements Needed to Monitoring and Evaluation of Rules Development as well as to the Transparency of OMB Regulatory Reviews, Gov’t Accountability Off. 17 (Apr. 2009), http://www.gao.gov/assets/290/288538.pdf (https://perma.cc/A5N3-5DDH). Despite increasing presidential control of the administrative process, these figures have not changed.²⁷27.For instance, OMB and OIRA review has been embraced and enhanced by presidents since President Ronald Reagan “creat(ed) a mechanism by which the Office of Management and Budget . . . would review all majority regulations of executive branch agencies.” Elena Kagan, Presidential Administration, 114 Harv. L. Rev. 2245, 2247 (2001). For instance, in 1992 Professor Thomas O. McGarity reported that rulemaking by the FTC took, on average, five years and three months. ²⁸28.Thomas O. McGarity, Thoughts on “Deossifying” the Rulemaking Process, 41 Duke L.J. 1385, 1389 n.22 (1992).

And if history is any indicator, the lethargic pace of agency rulemaking is unlikely to change in the future. Ossification, then, has the effect of keeping regulation in place despite expressed deregulatory pressures.

Agency staff exacerbates this ossification because they will be required to carry out Trump’s deregulatory policies. ²⁹29.Throughout this Essay, I refer to the current administration as a pertinent example. The impediments to deregulation in the face of a pro-deregulation presidential administration are not limited to the current administration. And while agency staff has become, over the past few administrations, “more [of] an extension of the President’s own policy and political agenda . . . no President . . . c[an] . . . supervise so broad a swath of regulatory activity.” ³⁰30.Kagan, supra note 29, at 2248, 2250. At a technical level, staff is required to carry out the studies necessary to survive arbitrary and capriciousness review. If they are antagonistic towards Trump’s deregulatory agenda, they can stall the process. Moreover, while the actual requirements of regulation can be changed, agency staff can protest the deregulatory action by increasing the number of audits or internal investigations at individual financial firms—changing their oversight policy from one of capital requirements to one of more extensive auditing.

Finally, at the end of a presidential administration, agencies may finalize a tremendous amount of rules in order to stay the hand of the new president.³¹31.See Mendelson, supra note 8, at 561–64. This can create hurdles for the new president for the reasons discussed above—changing a rule requires costly and time-consuming rulemaking. And ossified rules present a challenge for regulated entities in that political rhetoric does not immediately translate into laxer regulatory schemes. For regulations that require large capital investments, this can be seen as a positive—ensuring regulated parties that the regulatory scheme will not be upended before the return on their investments are realized.³²32.See Nielson, supra note 11. But for structural regulation—such as bank capital requirements or privacy concerns—ossification imposes costs and limitations on firms far after the administration has deemed those costs unwarranted.

2. Burrowing

Just as new rules are promulgated at the end of a presidential administration, so too do abrupt staffing changes occur. At the end of President Clinton’s administration, over “one hundred political appointees moved to civil service positions³³33.Mendelson, supra note 8, at 563 n.27. Furthermore, “[o]utgoing political appointees may also hire significant numbers of civil servants or promote individuals to key supervisory positions inside the agency, [] with an eye to ensuring that the outgoing administration’s viewpoints and priorities remain represented within the agency.”³⁴34.Id. at 563–64.

Junking up an agency with those sympathetic to an outgoing president’s point of view imposes costs on the new administration. Antagonistic staff can hamper agency heads from engaging in a cohesive policy strategy. Moreover, agency staff is usually tasked with identifying the agency’s agenda or the pathways through which the political agenda can be accomplished.³⁵35.Cf. id. at 610–16. This subversive behavior can be “passive,” by letting deadlines slip, dragging out assignments, or overloading political appointees with needless information to stall agency activity.³⁶36.See id. at 612–13. Of course, this subversion can also take an active form through leaks and other signs of disagreement. Like the legal hurdles to deregulation, these too can be overcome by a presidential administration bent on deregulating. But it is important to note that they increase the costs and time to deregulate in ways that may harm the effort globally.

Agency burrowing can also take the form of enforcement shifting whereby agency staff antagonistic towards the political views of the president increases other forms of regulatory burdens (e.g., audits or inspections) due to a perceived decline in top-down regulation. This is not merely a theoretical exercise. Scholars have observed that the rank-and-file agency staff responds to what they perceive as negative changes in policy.³⁷37.See, e.g., Dan Wood, Principals, Bureaucrats, and Responsiveness in Clean Air Enforcements, 82 Am. Pol. Sci. Rev. 213, 213 (1988) (finding “that the influence of elected institutions is limited when an agency has substantial bureaucratic resources and a zeal for their use”); see also Hemel, supra note 13 (briefly summarizing the literature and noting that Trump “might not have the bureaucratic buy-in necessary to carry those policies through”). For instance, in response to President Ronald Reagan’s “outright assault . . . on environmental programs” and a decline in the agency’s budget, the Environmental Protection Agency’s monitoring and abatement activity surprisingly increased during the early part of the Reagan administration.³⁸38.Wood, supra note 39, at 217–27. The EPA was able to successfully circumvent parts of Reagan’s assault on environmental regulations because the “bureaucratic interest in shaping policy outputs” is sometimes strong enough to overcome presidential control.³⁹39.Id. at 229. Ultimately, presidential administrations can impact policy, but agencies themselves are “responsible for much of the . . . public policy” implementation.⁴⁰40.Id.

This too has obvious deleterious effects on regulated entities. While official regulation is being slowly repealed, firms may be exposed to increased regulatory action through audits and other informal regulatory processes. This mismatch creates uncertainty that makes it difficult for firms to plan ahead. Although they can see formal deregulation occurring and plan investment changes accordingly, they simultaneously see an increased need to spend more time working with regulators. Firms may be accustomed to such bipolar regulatory responses, but they nonetheless force internal regulatory processes to persist within firms.

3. Prosecutorial Discretion

Finally, agencies—and their staff—possess extraordinary discretion when bringing enforcement actions. As SEC v. Chenery Corporation ⁴¹41.332 U.S. 194 (1947). tells us, agencies may choose between rules and adjudication in creating policy positions. But that does not end the story. After Heckler v. Chaney, ⁴²42.470 U.S. 821 (1985). an agency’s decision to not bring enforcement action—as well as its decision to bring enforcement action—is effectively unreviewable. Except for the fact that the agency personnel bringing the enforcement action must be separated from those adjudicating the action⁴³43.See 5 U.S.C. § 554(d) (2006). agency personnel have complete discretion to bring enforcement actions.

Traditionally, enforcement was an after-thought in terms of agency policy—the focus on rulemaking either through notice and comment or adjudication. But increasingly, agencies have used enforcement—or the threat of enforcement—to regulate entities in ways that may expand the regulator’s purview or the agency’s policy portfolio⁴⁴44.See Matthew C. Turk, Regulation by Settlement, 66 Kansas L. Rev 259 (2017). The lengthy procedural processes that the APA and the courts have foisted on agency rulemaking makes regulation via enforcement attractive—the courts have limited review of these decisions, and settlement agreements allow for tailored enforcement of individual firms.

Regulation through enforcement and settlement also has ripple effects on other firms in the industry. The potential for enforcement threats, especially after enforcement against a similar firm has been observed, may change how firms behave. If firms in an industry observe an agency threatening enforcement against a competitor for a practice that might be prohibited by current regulation, they may change their policies in anticipation⁴⁵45.See Id. The cost of litigating against the agency is high and generally unrecoverable. So a firm must balance the cost of litigating (and the probability-adjusted cost of losing that litigation) against the cost of compliance. In that sense, it is easy to see why firms settle and other firms comply with the thrust of the settlement ex post.

Especially as regulation has become more standards-based⁴⁶46.See infra Part I.B. the potential to expand the scope of regulation through the threat of enforcement increases. Of course, given the relative newness of enforcement through settlement, the persistence of this approach has not been studied. It may cut both ways. Appointed enforcement chiefs can stop bringing enforcement actions and can allow firms to stop complying with previously signed DPAs or stop ongoing litigation and investigation.⁴⁷47.See, e.g., Patrick Rucker, Exclusive: Trump Official Quietly Drops Payday Loan Case, Mulls Others - Sources, Reuters (Mar. 23, 2018, 3:04 AM), https://www.reuters.com/article/us-usa-cfpb-payday-exclusive/exclusive-trump-official-quietly-drops-payday-loan-case-mulls-others-sources-idUSKBN1GZ1A9 (https://perma.cc/7WJ3-S82Z). On the other hand, burrowing may allow for ongoing minor enforcements and the continued enforcement of settlements. And even for deregulatory administrations, high-level enforcements may be politically attractive.

B. The Evolving Nature of Regulation

“[P]rivate firms increasingly exercise regulatory discretion of the type delegated to agencies.” ⁴⁸48.Bamberger, supra note 9, at 383. regulation’s goals have become more complex, regulators have shifted their focus from command-and-control directives to more performance-based models⁴⁹49.See id. at 385–89. This is not a recent phenomenon. President Clinton required that agencies, “to the extent feasible, specify performance objectives, rather than specifying the behavior or manner of compliance that regulated entities must adopt.”⁵⁰50.Regulatory Planning and Review, Exec. Order No. 12,866, § 1(b)(8), 3 C.F.R. 638 (1994); see also Improving Regulation and Regulatory Review, Exec. Order 13,563, § 1(b)(4), 3 C.F.R. 13,563 (2012) (continuing the mandate).

Historically, regulators employed “technology-based” regulation that “intervene[d] in the acting stage, specifying technologies to be used or steps to be followed⁵¹51.Cary Coglianese & David Lazer, Management-Based Regulation: Prescribing Private Management to Achieve Public Goals, 37 Law & Soc’y Rev. 691, 694 (2003). But increasingly, regulators are employing “performance-based” and “management-based” regulatory schemes. “Performance-based approaches intervene at the output stage, specifying social outputs that must (or must not) be attained. In contrast, management-based approaches intervene at the planning stage, compelling regulated organizations to improve their internal management so as to increase the achievement of public goals.”⁵²52.Id.

For example, the Nuclear Regulatory Commission’s Reactor Oversight Process does not mandate particular technologies or processes. Rather, it relies on a bevy of performance indicators to “assess the safety and security performance of operating commercial nuclear power plants.”⁵³53.See NRC: Reactor Oversight Process (ROP), U.S. Nuclear Reg. Comm’n (Apr. 20, 2018), https://www.nrc.gov/reactors/operating/oversight.html (https://perma.cc/DC9D-WPCF). Mandating specific technologies risks becoming outdated or depresses innovation, so the agency allows plants to conduct their operations organically. Inspections are conducted annually to observe the plant’s conditions and understand any trends or emerging risks, but the design and implementation of a safety and soundness program is left to the individual plants.⁵⁴54.See NRC Inspection Manual, U.S. Nuclear Reg. Comm’n (Oct. 3, 2017), https://www.nrc.gov/docs/ML1726/ML17264A782.pdf (https://perma.cc/BX7U-ER6L).

Another “prominent example is the No Child Left Behind Act,” which “requires schools to achieve specified academic results as measured by a variety of indicators.”⁵⁵55.Galit A. Sarfaty, Regulating Through Numbers: A Case Study of Corporate Sustainability Reporting, 53 Va. J. Int’l L. 575, 583 (2013). No Child Left Behind gave discretion to individual schools districts—they could choose what strategy, technologies, and processes worked best to accomplish the Act’s broad goals.

These are not isolated examples. Financial regulation, environmental regulation, and food safety regulation, to name a few, allocate some regulatory authority to the regulated entities.⁵⁶56.“Dissatisfaction . . . with traditional regulatory strategies has prompted interest in alternatives to traditional command and control regulation” including “a wide range of ‘rule at a distance’ methods in which various forms of standard-setting and self-regulation are used instead of more command-and-control based forms.” Scott Burris, Michael Kempa & Clifford Shearing, Changes in Governance: A Cross-Disciplinary Review of Current Scholarship, 41 Akron L. Rev. 1, 38 (2008). For instance, in the context of financial regulation scholars have noted that “(t)he administrative state, through regulatory law, uses internal corporate structures to effectuate public policy, which effectively transforms the large corporation into a quasi-governmental actor that functions as a kind of self-regulatory organization.” Mercer Bullard, Caremark’s Irrelevance, 10 Berkeley Bus. L. J. 15, 22 (2013). In food safety regulation, the Federal Food, Drug, and Cosmetic Act “requires owners and operators of food facilities to evaluate the hazards that could affect food, and implement and monitor preventative controls.” Diana R. H. Winters, Not Sick Yet: Food-Safety-Impact Litigation and Barriers to Justiciability, 77 Brook. L. Rev. 905, 911–12 (2012). A full review of the regulatory shift is outside the scope of this Essay, but the examples help change the general perspective of what regulation is, especially as it relates to regulated entities. Typically, regulation is thought of as a binary—build X to decrease carbon emissions, add Y to cars to make them safer—but in more complex industries, the regulation is more prudential—implement changes to make the financial system safer, ensure that users’ data is protected and private, consider the efficacy of medical procedures on a hospital’s treatment policies. This shift is a necessary part of this Essay’s thesis.

Take, for example, the canonical case of Motor Vehicles Manufacturers Association v. State Farm Mutual Automobile Insurance Company.⁵⁷57.463 U.S. 29 (1983). The fight in that case was over whether seatbelts or airbags would be installed in cars (and when)—a binary outcome. Either car manufacturers would have to invest capital to change their production process or they wouldn’t. But once they changed the process, there would be no thought about it—the capital invested, the regulation was effectively implemented. Modern regulatory schemes have changed this binary outcome. To use a highly politicized example, the Patient Protection and Affordable Care Act,⁵⁸58.42 U.S.C. § 18,001 (2012). requires the development of a National Quality Strategy to promote efficiency and efficacy of healthcare delivery.⁵⁹59.Id. at §§ 3011–15. That is not a binary outcome for insurers and healthcare providers—it requires these firms to build internal units that can collect data, analyze the data, and propose recommendations (in addition to thinking about what data is valuable). These changes in regulatory strategy affect how firms structure their responses to regulation and, ultimately, may have persistent effects on firms’ structure even in a deregulatory environment.

II. Firm Responses to Regulation: Theories of Institutional Change in Response to Deregulatory Pressures

Firms respond to regulatory pressures. But missing from recent analysis is an understanding of how more complex, bottom-up regulation affects firm structure. Structure matters. Investment in a plant can be abandoned if deregulation makes its operation inefficient or unnecessary. But structure dictates how decisions are made. Responding to traditional, top-down regulation is easy: firms purchase the required equipment or invest in the necessary preventative apparatus. In essence, it is binary and likely does not require much change to current processes or procedures. For instance, when the FDA mandates that warnings be in a certain sized font,⁶⁰60.See, e.g., 21 C.F.R. § 1143.5(a) (2018) (requiring cigar manufacturers to place warning on their products “in at least 12-point font” that is “printed in conspicuous and legible Helvetica bold or Arial bold type”). pharmaceutical manufactures change the label, but they do not change their research processes. But adhering to more complex regulation, such as the Federal Reserve requiring systemically important financial institutions conduct stress tests on their assets, requires increased staff, centralization of information, and coordination inside the firm. Responding to regulation by structurally changing organizational processes may fundamentally alert the organization and allow these changes to persist in the absence of regulation. To make that point clear, this Essay first proceeds by highlighting financial firms’ responses to Dodd-Frank through related antidotes. This Essay then turns to the heart of the matter—providing several theories of institutional change that will keep internal firm structures changed in the absence of regulation.

A. Firm Responses to Increased Regulation Through the Lens of Dodd-Frank

After the passage of Dodd-Frank, the rise of the regulatory, risk, and compliance staffs at financial institutions has been stunning. Or, as Bloomberg put it, the last few years have witnessed “the [r]ise of the [c]ompliance [g]uru.”⁶¹61.Anthony Effinger, The Rise of the Compliance Guru—and Banker Ire, Bloomberg, (June 25, 2015, 3:00 AM PDT), http://www.bloomberg.com/news/features/2015-06-25/compliance-is-now-calling-the-shots-and-bankers-are-bristling (https://perma.cc/CQ5C-4XH8). For instance, JPMorgan Chase, the largest U.S. bank by assets,⁶²62.Large Commercial Banks, Fed. Res. (Sept. 30, 2017), https://www.federalreserve.gov/releases/lbr/current (https://perma.cc/AK3X-SAKR). increased the number of in-house regulators by over seventy-five percent from 2011 to 2015.⁶³63.Annual Report 2015, JPMorgan Chase & Co. 15 (2016), http://www.jpmorganchase.com/corporate/investor-relations/document/2015-annualreport.pdf (https://perma.cc/AHM8-247W) (“Since 2011, our total headcount directly associated with Controls has gone from 24,000 people to 43,000 people, and our total annual Controls spend has gone from $6 billion to approximately $9 billion annually over that same time period.”). JPMorgan is not an isolated example—other financial institutions have seen a similar rise in the number of staff devoted to regulation, risk, and compliance. At Goldman Sachs, in just one year, “[t]otal staff increased 8% . . . primarily due to . . . continued investment in regulatory compliance.”⁶⁴64.Annual Report 2016, The Goldman Sachs Group, Inc. 57 (2017), http://www.goldmansachs.com/investor-relations/financials/current/annual-reports/2016-annual-report/annual-report-2016.pdf (https://perma.cc/XZT8-X68P). Perhaps more tellingly, it is becoming more difficult to staff these types of jobs, with senior compliance officers complaining of “staffing challenges.”] Even non-US banks are increasing the size of their internal regulatory staff—by 2014, one-in-ten HSBC employees was an in-house regulator.⁶⁵65.Margot Patrick, HSBC Third-Quarter Earnings: Key Takeaways, Wall St. J. (Nov. 3, 2014, 6:05 AM ET), http://blogs.wsj.com/moneybeat/2014/11/03/hsbc-third-quarter-earnings-key-takeaways (https://perma.cc/YDA2-XHDV). Moreover, based on a 2016 survey of bank chief risk officers and other senior in-house regulators, “the upward [hiring] trend will likely continue overall, as the majority of firms expect to add more professionals to headcount in the next year.”⁶⁶66.A Set of Blueprints for Success, EY & Institute of International Finance 13 (2016), http://www.ey.com/Publication/vwLUAssets/ey-a-working-set-of-blueprints-to-deliver-sustainable-returns/$FILE/ey-a-working-set-of-blueprints-to-deliver-sustainable-returns.pdf (https://perma.cc/WF4A-YC5W).

Regulatory demands have driven most of the increases in in-house regulator headcount. But this unprecedented growth has been coupled with increased institutionalization of these functions. For instance, prior to 2008, the Chief Risk Officer at Morgan Stanley reported solely to the Chief Executive Officer.⁶⁷67.See Form 10-K: Annual Report Pursuant to Section 13 or 15(d) of the Securities Exchange Act of 1934 for the Year Ended December 31, 2010, Morgan Stanley 97, https://www.sec.gov/Archives/edgar/data/895421/000119312511050049/d10k.htm (https://perma.cc/EQB3-HNW3). But now the Chief Risk Officer reports directly to both the Board of Directors and the CEO.⁶⁸68.See Form 10-K, Annual Report Pursuant to Section 13 or 15(d) of the Securities Exchange Act of 1934 for the Year Ended December 31, 2016, Morgan Stanley, 75–76, https://www.sec.gov/Archives/edgar/data/895421/000119312517059212/d328282d10k.htm (https://perma.cc/R5GQ-S5T7). A similar transition has occurred at Citigroup, where the Chief Risk Officer now “has regular and unrestricted access to the Risk Management Committee of the Board.”⁶⁹69.Form 10-K: Annual Report Pursuant to Section 13 or 15(d) of the Securities Exchange Act of 1934 for the Year Ended December 31, 2016, Citigroup, Inc. 65, https://www.sec.gov/Archives/edgar/data/831001/000083100117000038/c-12312016x10k.htm (https://perma.cc/B5BA-4RR7). In perhaps a greater transformation, the Chief Risk Officer of Goldman Sachs previously reported to senior management (including the CEO, President, and CFO).⁷⁰70.See Form 10-K: Annual Report Pursuant to Section 13 or 15(d) of the Securities Exchange Act of 1934 for the Year Ended December 31, 2011, Goldman Sachs Group, Inc. 84, http://www.sec.gov/Archives/edgar/data/886982/000119312512085822/d276319d10k.htm (https://perma.cc/B2L2-75K4). Now Goldman’s Chief Risk Officer reports to both the CEO and the Board of Directors.⁷¹71.See Form 10-K: Annual Report Pursuant to Section 13 or 15(d) of the Securities Exchange Act of 1934 for the Year Ended December 31, 2016, Goldman Sachs Group, Inc. 84, https://www.sec.gov/Archives/edgar/data/886982/000119312517056804/d308759d10k.htm (https://perma.cc/6NYA-E4P5).

Banks responded to Dodd-Frank in predictable ways—regulated entities generally seek to comply with new rules. But most scholars assume that firms will respond to deregulation in the same predictable way, by deconstructing the regulatory apparatus they created internally. The basic understanding of firms as profit-maximizing machines—and managers as agents for shareholders focused on earnings—highlights why this understanding is persuasive. This view of firms is present in both administrative law and corporate law literatures.⁷²72.See Timothy F. Malloy, Regulation, Compliance and the Firm, 76 Temp. L. Rev. 451, 453–55 (2003); Robert A. Prentice, The Inevitability of a Strong SEC, 91 Cornell L. Rev. 775, 780 (2006) (“In the deregulation worldview, investors, securities professionals, and ancillary actors such as auditors and attorneys are rational.”). See also supra note 10.

Most of the current literature on firm regulatory response is focused on mandates—forced firm behavior.⁷³73.See, e.g., Tom Ginsburg et al., Libertarian Paternalism, Path Dependence, and Temporary Law, 81 U. Chi. L. Rev. 291 (2014) (discussing the stickiness of a smoking moratorium in bars). It does not seek to explain how complex, standards-based regulatory frameworks change regulated entities and cannot explain their response to deregulation. It suggests that sunk costs and switching costs may make singular investments or choices stable in a deregulatory environment⁷⁴74.See Nielson, supra note 12, at 133. That theory has some purchase in this context—the specter of regulations’ return poses switching costs—but is not robust in the presence of most modern regulatory schemes. Dodd-Frank required financial firms to hire an enormous amount of regulatory staff and was enormously costly,⁷⁵75.For instance, Dodd-Frank alone costs banks an estimated $36 billion. Dodd-Frank Costs Reach $36 billion in Sixth Year, Bloomberg Brief (July 22, 2016), https://www.bloomberg.com/professional/blog/dodd-frank-costs-reach-36-billion-sixth-year-2 (https://perma.cc/NRR5-RT2S). but the switching costs seem limited—laying off the regulatory staff may have psychic costs, but is otherwise a profitable move.

Cutting against that logic, I suggest that forces inside and outside the firm moderate the tendency to “deregulate” inside the firm. Indeed, Judge Richard Posner has noticed, “[d]eregulation does not bring about automatic changes in firm behavior. It changes the incentives facing management, and managers differ in their ability to respond intelligently to changes in incentives.”⁷⁶76.Richard A. Posner, The Effects of Deregulation on Competition: The Experience of the United States, 23 Fordham Int’l L. J. S7, S17 (2000). Below, I suggest several theories that may explain why firms will not respond to deregulation as expected. These theories are not mutually exclusive and some are more likely to be present in certain types of industries. Although some empirical evidence “suggests that older firms, firms that were profitable before deregulation, and family firms are apt to be more sluggish in responding to the challenges of deregulation than firms having the opposite attributes⁷⁷77.Id. limited work has been done to construct theoretical arguments explaining that sluggishness.

The point is not to draw absolute conclusions about how firms will react; rather, the aim is positive and theoretical—to present a series of theories that punch against prevailing wisdom. Certainly more study of individual firms and industries will be necessary to test these theories, but they suggest prevailing wisdom may be incomplete.

B. Internal Forces of Regulatory Inertia

1. Agency Costs

Jensen and Meckling revolutionized corporate governance by conceptualizing firms as a nexus of contracts. A firm—in their view—“is a legal fiction which serves as a focus for a complex process in which the conflicting objectives of individuals . . . are brought into equilibrium with a framework of contractual relations.”⁷⁸78.Michael C. Jensen & William H. Meckling, Theory of the Firm: Managerial Behavior, Agency Costs and Ownership Structure, 3 J. Fin. Econ. 305, 311 (1976). The result of these contracts—between a principal, owner and agent, manager—is agency costs. Agency costs arise from the divergent interests of the principal and the agent. An owner has delegated responsibility of the firm to the manager. The owner wants the manager to maximize profits, but the manager is striving to maximize her compensation, potentially to the detriment of the owner. And, as the gap between principal and agent grows, so does this relationship’s agency costs.⁷⁹79.See id. at 334–37.

Agency costs exist not just at the owner–manager level, but also between senior and junior managers.⁸⁰80.See, e.g., Sungbin Cho, Specialization, Agency Cost and Firm Size, Econometric Soc’y 2004 Far Eastern Meetings 705 (2004). As such, agency costs may stymie managers attempting to trim the size of their firm’s regulatory staff in a deregulatory environment. Regulatory staff has great autonomy and, within the firm, is expert on its processes and regulatory developments. In a deregulatory environment, they can use this expertise to their advantage. Ossification, burrowing, and prosecutorial discretion slows deregulatory rhetoric from directly translating to reduced regulatory burdens.⁸¹81.See supra Part I.A. While senior managers may want to reduce regulatory staff, the regulatory staff wants to maintain its size, stature, and salary. But because senior managers have less expertise in the guts of regulation, in-house regulators can use their expertise—coupled with the technicalities around ossification and the like—to encourage managers to reassess their initial inclinations.

Highlighting recent regulatory actions that occur in a deregulatory environment could be one technique regulatory staff employs to mitigate management’s view on deregulation. Even though presidential rhetoric is favorable, burrowing and prosecutorial discretion create enforcement opportunities that in-house regulators can seize. Take, for example, the Federal Reserve’s recent treatment of Wells Fargo. Because of regulatory lapses in the past, in February of 2018, the Federal Reserve fined Wells Fargo and prevented them from expanding until the issues are fixed.⁸²82.Emily Flitter et al., Federal Reserve Shackles Wells Fargo After Fraud Scandal N.Y. Times (Feb. 2, 2018), https://www.nytimes.com/2018/02/02/business/wells-fargo-federal-reserve.html (https://perma.cc/YQ7X-FGFF).

Bank compliance staff can employ this example should their managers seek to trim staff because of deregulatory presidential rhetoric. All else equal, compliance staff prefer to preserve their jobs than increase bank profits, so they can use the Wells Fargo example to argue that their positions are valuable—the staff may still be able to regulate despite top-down guidance. Moreover, because their knowledge of the regulatory landscape is greater than senior management’s, the regulatory staff can use burrowing and prosecutorial discretion to their advantage. They can assert that the Wells Fargo example is not an anomaly, but the result of regulatory resistance that will persist even as deregulation makes its way through the ossified process.

And despite agency costs theory’s prescription to centralize decision-making,⁸³83.See Fletcher Cyclopedia of the Law of Private Corporations, § 1037 (2017). management theory and practice increasingly push firms to decentralize decision-making.⁸⁴84.See generally Thomas W. Malone, Decentralization is the New Center of Command (Harvard 2010). Decentralization has a pernicious downside—divisions will seek rents. This rent-seeking behavior can manifest itself in increased salaries or, more likely, larger budgets.⁸⁵85.See generally David S. Scharfstein & Jeremy C. Stein, The Dark Side of Internal Capital Markets: Divisional Rent-Seeking and Inefficient Investment, 6 J. Fin. 2537 (2000). Scharfstein and Stein develop a two-tier model of agency costs—agency costs between investor and manager, and manager and division heads.⁸⁶86.Id. To maintain the division heads of weaker divisions, they predict that the manager will “pay” them with increased budgets, rather than increased salary. Weaker divisions will always rent seek while stronger divisions will not, and to retain the division head, the manager will “tilt the capital budget in his direction.”⁸⁷87.Id. at 2551. That is optimal for both the manager—who prefers to pay in capital investment rather than salary—and the division head.

The theory applies to in-house regulators. The division head—the Chief Risk Officer, the Chief Privacy Officer—will rent-seek in a deregulatory environment because their divisions will be “weaker” all else equal. The manager cannot do away with the division head, but will prefer to expand his budget rather than pay cash wages. In theory, cash wages reduce the manager’s flexibility to pay himself and others, but the “successful” units can subsidize the capital investment in the weaker division without harming the manager’s cash flexibility.

Theory aside, Scharfstein and Stein suggest that the agency costs that afflict managers and division units manifest themselves in greater budgets for the weaker units. For in-house regulators, this creates a type of one-way ratchet.⁸⁸88.Id. In times of increasing regulation, firms spend capital to comply. But in deregulatory environments, rent seeking causes firms to undercompensate in-house regulators in real terms, but overinvest in in-house regulators (that is, in-house regulator’s may see their budgets grow while their wages stagnate). Agency costs theory, then, supports the notion that deregulation does not swiftly flow through firms—the internal dynamics of firms belie an immediate reduction in the size and sophistication of the firm’s regulatory staff.

2. Manager-Specific Investments

Managers are subject to pressures that align their interest with that of shareholders. The board and other senior leaders monitor managers for compliance with their profit-maximizing strategy. Moreover, the active labor market also reigns in a manager’s tendency to shirk, that is act in a way that is beneficial to her but to the shareholders’ detriment.

But these mechanisms are imperfect. Managers often act in self-interested ways. One theory for this is managerial entrenchment—the idea that managers make specific investments that subsequently make them “valuable to shareholders and costly to replace.”⁸⁹89.Andrei Shleifer & Robert W. Vishny, Management Entrenchment: The Case of Manager Specific Investments, 25 J. Fin. Econ. 123, 123 (1989). entrenchment may occur at any level of the organization. “A secretary, for example, has an incentive to design ways of keeping records or computer files that are very costly for anyone else to figure out.”⁹⁰90.Id. at 124.

In the mine-run case of entrenchment, boards (or anyone with oversight authority) allow managers to make entrenching investments because they are “insufficiently well informed to evaluate the investment, or because board members approve of the manager’s basic corporate strategy.”⁹¹91.Id. at 126. This may prove especially troublesome in the regulatory context, as boards cannot protect themselves from such investments. New regulation forces firms to invest in new, specific functions, and out of necessity, those implementing the regulation within the firm will be best positioned to determine how to invest. This creates an incentive for in-house regulators to invest inefficiently, that is invest to entrench.

Recent examples from financial regulation are apt. As financial regulators have placed increased demand on firms to oversee the risks being taken and develop comprehensive systems to analyze and monitor these risks, the in-house regulators tasked with this project have seen their staff and budgets balloon. Off-the-cuff risk management techniques traditionally done on trading desks moved to sophisticated risk tracking systems done by in-house regulators. The models and data that these systems spit-out is opaque—knowledge of risk metrics and other ideas is a necessary prerequisite to understanding what is going on. In the presence of regulation, the in-house regulators have made themselves valuable because they have built systems that they have a comparative advantage at understanding and decoding. Moreover, the centralization has meant that those on the trading desks that historically were called upon to do the quick-and-dirty risk management tasks of yore, no longer exist or have the expertise to do so. Therefore, investment in specific technology has increased the value of in-house regulators and made them more difficult to get rid of even in a deregulatory universe.

Of course, if the regulatory function is no longer valuable in a deregulatory universe, these investments will not lead to entrenchment—managers may eliminate the investments.⁹²92.But see infra Part II.A.3 (The value may come from transferability of knowledge that occurs.). But modern regulation’s scope has pervasive effects on firm operations. As the example above illustrates, the investments that in-house regulators make change how the firm itself is organized and operates. In line with the manager-specific investment thesis, in-house regulators will overinvest in systems that provide them with control over information or other inputs into firm operations. Normally, Boards would curtail overinvestment, but because of regulation’s complexity, they may not have the tools to properly account for what is needed, and the risk of undercompliance is high (and Boards may well be risk averse when it comes to compliance). The traditional check on manager-specific investments is muted in the regulatory landscape because the person with the most information about costs—the in-house regulator—has an incentive to inflate the costs to entrench herself and her staff.

3. Specific Knowledge, Centralization, and Switching Costs

“[M]anagement-based regulation will typically require information collection.”⁹³93.Coglianese & Lazer, supra note 53, at 695. This is not surprising; modern regulation emphasizes monitoring and modeling—approaches that require centralized information collection. But this centralization may make in-house regulators sticky.

Another theory of the firm posits that it is an institutional arrangement to integrate the individuals’ knowledge.⁹⁴94.See generally Robert M. Grant, Toward a Knowledge-Based Theory of the Firm, 17 Strategic Mgmt. J. 109 (1996). Knowledge is not held by the firm, but rather by individuals employed by the firm. Some of that knowledge is easily transferable (e.g., the number of employees in Human Resources or the price of a necessary input per a contract with the supplier). But most valuable knowledge is not easily communicated or transferable—“[t]acit knowledge is revealed through its application.”⁹⁵95.Id.

Much of the knowledge housed in the minds of in-house regulators is this less transferable knowledge. The ability to monitor, analyze, and synthesize data is not easily transferred, even if the data itself is easily communicated. Moreover, decision making housed in firm regulatory departments is a classic form of tacit knowledge—the combinations of data that each situation requires taking into account is not routine and can only be developed through use.⁹⁶96.See generally Michael C. Jensen & William H. Meckling, Specific and General Knowledge and Organizational Structure, 8 J. Applied Corp. Fin. 251 (1995).

Firm production requires the integration of multiple people’s knowledge. As in-house regulators emerge or grow, they are likely to centralize tasks—and thus knowledge—in themselves. This makes them essential components of firm production. Once “production requires the integration of many people’s specialist knowledge, the key of efficiency is to achieve effective integration while minimizing knowledge transfer through cross-learning by organizational members.“⁹⁷97.Grant, supra note 97, at 114 (emphasis added).Dependence on in-house regulators’ knowledge makes them a valuable component of production. Deregulation should, thus, not have as great an impact as previously imagined because, although regulatory responsibilities are one component of their tasks and their origin, the integration of their knowledge into firm production means that they are now a more essential component of firm production. The firm’s ability to aggregate knowledge towards a productive means is what makes it competitive and profitable. Once in-house regulators are part of the knowledge aggregation process, removing them may change the firm’s production function and impact profitability.

After Dodd-Frank, financial firms were required to stress test their entire portfolios annually for the Federal Reserve. As discussed above, this herculean effort required centralizing data—and the ability to understand, manipulate, and synthesize that data—in risk departments. But this knowledge is valuable for everyday production. The profitability of a trade depends on whether it will offset overall risk, and now risk departments are central to understanding the complexity of a firm’s portfolio.

Moreover, the most efficient way to organize knowledge in a hierarchical organization is through bureaucracy.⁹⁸98.See id. at 118 (Once firms are viewed as institutions for integrating knowledge, a major part of which is tacit and can be exercised only by those who possess it, then hierarchical coordination fails . . . . Only one of the integration mechanism . . . is compatible with hierarchy: integration through rules and directives.”). “In the knowledge-based firm, rules and directives exist to facilitate knowledge integration; their source is specialist expertise which is distributed throughout the organization.”⁹⁹99.Id. Generally, in-house regulators are viewed as setting up procedures and protocols that facilitate compliance. But these same procedures are used to integrate knowledge across the firm—they exist not just to satisfy compliance but to structure knowledge integration to coordinate production.

The neoclassical retort to this line of reasoning is simple: if these processes and groups were valuable before regulation, they would have existed. Perhaps, but internal efficiency must be balanced against the high switching cost of knowledge transfer. Of course, it may be the case that the structure of firms ex ante was efficient, but once forced to restructure by regulation, the unraveling of the structure in a deregulatory universe imposes switching costs that may mitigate any efficiency gains that materialized in the previous organizational form.

4. Professionalization, Advocacy, and Culture

Regulating a firm requires expertise, and in-house regulators have become increasingly professionalized. The oft-maligned revolving door is one manifestation of professionalization—in-house regulators’ expertise is difficult to acquire and ex-regulators may be best positioned to understand in-house regulators’ roles. Regulation may also drive professionalization.¹⁰⁰100.See generally David B. Clarke et al., No Alternative? The Regulation and Professionalization of Complementary and Alternative Medicine in the United Kingdom, 10 Health & Place 329 (2004) (discussing the increased professionalization of alternative medicine after Parliamentary Inquiry). Isolating or signaling out specific expertise may lead individuals across firms to associate. For example, privacy officers became increasingly professionalized after regulation encouraged firms to hire more of them.¹⁰¹101.Kenneth A. Bamberger, Privacy on the Books and on the Ground, 63 Stan. L. Rev. 247, 277 (2010) (noting the importance of “the increasingly professionalized privacy-officer community”).

But increased professionalization has a downside for organization: it creates individual tension between professional norms and organizational priorities.¹⁰²102.See Margali S. Larson, The Rise of Professionalism: A Sociological Analysis 190–91 (Transaction Publishers 1977). Because most in-house regulators are, necessarily, somewhat separated from the other operations of the firm, they may develop a professional ethos or culture focused on attaining their perceived goal rather than focusing on optimizing firm goals. Given the headwinds to downsizing in-house regulators, the establishment of a culture of compliance not only leaves the in-house regulators in place but also leaves traces of the regulatory mandate in place.¹⁰³103.See William A. Birdthistle & M. Todd Henderson, Becoming a Fifth Branch, 99 Cornell L. Rev. 1, 46 (2013) (noting that financial compliance staffs may build a “culture of compliance” that is difficult for the rest of the firm to overcome).

This is not to say that in-house regulators won’t change their culture or focus in a deregulatory environment—over time, they will respond to the incentive scheme that exists. And environmental factors may contribute. For example, financial risk managers and compliance professionals may be more likely to develop a culture of compliance because they co-located—most of these professionals live in the same few metropolitan areas. But there may be less cross-industry cultural development in privacy professionals or hospital administrators because of their geographic diversity. In any event, change may be slow, and given deregulation in fact already lags deregulatory rhetoric, the shadow of regulation in a deregulatory universe may be longer than previously anticipated. Indeed, it may outlast the administration proposing the deregulation, at which point the future fear of regulation may become another force that creates persistence among in-house regulators (see below).

5. Repositioning the Regulatory Agenda

What’s more, regulatory staff may entrench themselves by repositioning their role. What starts out as a regulatory mandate becomes a competitive advantage.

Take, for example, State Street’s “Fearless Girl,” the bronze statue of a young woman placed in front of the notorious Wall Street Bull.¹⁰⁴104.Sapna Maheshwari, Statue of Girl Confronts Bull, Captivating Manhattanites and Social Media, N.Y. Times (Mar. 8, 2017), https://www.nytimes.com/2017/03/08/business/media/fearless-girl-statue-wall-street-womens-day.html (https://perma.cc/64CF-YSXF). By building the statue, State Street signaled its commitment to employing its power to increase diversity on corporate boards. State Street may have legitimate business reasons for doing so,¹⁰⁵105.See George Tepe, Boards Should Use Diversity as a Defense Against Activists, CLS Blue Sky Blog (Sept. 21, 2017), http://clsbluesky.law.columbia.edu/2017/09/21/boards-should-use-diversity-as-a-defense-against-activists (https://perma.cc/5YQC-D6P2). but it also bolstered State Street’s progressive reputation and likely aided its quest to manage pension and endowment assets.¹⁰⁶106.See Maheshwari, supra note 107.

Regulation, in part, led to this approach. In its 2003 rule on Proxy Voting by Investment Advisors,¹⁰⁷107.See Final Rule: Proxy Voting by Investment Advisors, 17 C.F.R. § 275.206(4)-6, § 275.204-2 (2012), https://www.sec.gov/rules/final/ia-2106.htm (https://perma.cc/9HGF-PWQT). the SEC issued regulations that required Investment Advisors, like State Street, to vote in the best interest of their shareholders. Most large investment managers, including State Street, created dedicated corporate governance groups to consider how to vote the shares State Street controlled.¹⁰⁸108.See Dorothy S. Lund, The Case Against Passive Shareholder Voting, 43 J. Corp. L. 493, 515-20 (2018).

The policy goal behind the regulation is simple. If Investment Advisors consider only the interest of shareholders when voting, they will use their considerable power to increase the value of the firms that their shareholders are invested in. But, at State Street at least, this regulatory function was able to use its newfound expertise and power to reposition the regulatory function. Because of the nebulous nature of what is in the best interest of the shareholders, the corporate governance group was able to reposition itself as part of the sales force—using its votes to signal State Street’s values to current and future clients.

Although there is currently no proposal to remove the regulation that started this chain reaction, the group at State Street would likely persist even if that regulation were withdrawn. This reposition of the regulatory enterprise represents another way that in-house regulators attempt to entrench themselves. And in the State Street example, the corporate governance group gains more resources and maintains most of the group’s mission—voting in the interest of shareholders—while ensuring their future even in a deregulatory environment.

Empirical evidence suggests that board diversity has positive shareholder returns.¹⁰⁹109.See Tepe, supra note 108. But even if those empirical results are not robust, State Street’s governance team may be avoiding the regulatory mission with regard to some corporate governance decisions—for example, supporting directors on the basis of their gender—while accumulating resources and credibility with respect to its original mission. In this sense, if in-house regulators can reposition some of their tools to the firm’s benefit, it may allow them to continue to exercise most of the regulatory discretion they were initially given despite deregulatory pressures.

State Street’s “Fearless Girl” is not an isolated example. Energy firms have advertised how environmentally friendly they are.¹¹⁰110.See Miriam A. Cherry & Judd F. Sneirson, Chevron, Greenwashing, and the Myth of “Green Oil Companies,” 3 Wash & Lee Energy, Climate & Env’t 133 (2012). Similarly, the internal group driving this started because of regulatory pressure, but the group was able to reposition itself as a selling point to some clients—it turned regulatory compliance into a competitive advantage. This creates a feedback loop that furthers entrenchment. It may be that sales teams are expropriating the in-house regulators’ work for sales, but that does not undercut the point. If revenue-generating units perceive in-house regulators as valuable, they will continue to support internal regulatory efforts. Indeed, the more symbiotic the relationship becomes, the more sales goals may change how the in-house regulators operate and shift the sales teams dialogue with clients around how in-house regulators are a value-driver for clients. In part related to external reporting requirements discussed above, once clients are focused on this attribute, the firm will be loath to disband the group—it makes the group a profit center.

6. Regulatory Persistence as a Barrier to Entry

Finally, regulated industries may act strategically in keeping regulation to deter new entrants into the field. High compliance costs raise the cost of new entry and reduce the number of potential entrants. A reduction in potential entrants allows an industry to operate at higher profits than they would otherwise achieve, and thwarts threats to their business model.¹¹¹111.See Leora Klapper et al., Entry Regulation as a Barrier to Entrepreneurship, 82 J. Fin. Econ. 591 (2006).

Even in deregulatory environments, firms may use the professionalization of in-house regulators to increase barriers to entry. This insight combines two forces of in-house regulatory persistence: repositioning and professionalization. For instance, privacy protections can be seen not just as a compliance function but as a source of value—customers are more comfortable transacting with a company that has robust privacy protections. In the technology space, this may allow incumbents to increase the costs for new entrants. “Don’t give your data to New Company because they do not have robust protections,” can be a persuasive way to transfer industry professionalization into a barrier to entry, increasing profitability for incumbents.¹¹²112.See Birdthistle and Henderson, supra note 106, at 44.

This isn’t hypothetical. For example, industry experts expect Google and Facebook to benefit from Europe’s new privacy regulation, at the expense of smaller online advertising firms.¹¹³113.Sam Schechner & Nick Kostov, Google and Facebook Likely to Benefit From Europe’s Privacy Crackdown, Wall St. J. (April 23, 2018, 10:18 PM ET), https://www.wsj.com/articles/how-europes-new-privacy-rules-favor-google-and-facebook-1524536324 (https://perma.cc/998P-JA3K). Likewise, the Affordable Care Act gave hospitals and other healthcare organization an incentive to merge—larger organization can amortize regulatory costs over a larger sales base.¹¹⁴114.See Jeffrey A. Singer, Obamacare’s Catch 22, U.S. News (Aug. 11, 2016, 3:15 PM), https://www.usnews.com/opinion/articles/2016-08-11/obamacare-gave-rise-to-the-health-care-mergers-its-advocates-oppose (https://perma.cc/8FT6-UEVS).

C. External Forces of Regulatory Inertia

1. Board Risk Taking and Caremark Duties

Under Delaware law, boards have a duty to monitor the firm. That is, the board must “exercise a good faith judgment that the corporation’s information and reporting system is in concept and design adequate to assure the board that appropriate information will come to its attention in a timely manner as a matter of ordinary operations, so that it may satisfy its responsibility.”¹¹⁵115.In re Caremark Int’l Inc. Derivative Litig., 698 A.2d 959, 970 (Del. Ch. 1996). In-house regulators further this mission, and increased regulation gives them greater access to the board. Chief Risk Officers of financial firms now report directly, and regularly, to the board, as do privacy leaders.¹¹⁶116.See Kenneth A. Bamberger & Deirdre K. Mulligan, New Governance, Chief Privacy Officers, and the Corporate Management of Information Privacy in the United States: An Initial Inquiry, 33 L. & Pol’y. 477 (2011).

In 2006, the Delaware Supreme Court affirmed the Board’s duty to monitor under Caremark stating that:

Caremark articulates the necessary conditions predicate for director oversight liability: (a) the directors utterly failed to implement any reporting or information system or controls; or (b) having implemented such a system or controls, consciously failed to monitor or oversee its operations thus disabling themselves from being informed of risks or problems requiring their attention. In either case, imposition of liability requires a showing that the directors knew that they were not discharging their fiduciary obligations. Where directors fail to act in the face of a known duty to act, thereby demonstrating a conscious disregard for their responsibilities, they breach their duty of loyalty by failing to discharge that fiduciary obligation in good faith.¹¹⁷117. Stone v. Ritter, 911 A.2d 362, 370 (Del. 2006).

While Caremark appears to be a robust doctrine when spelled out on its terms, it is severely limited. For instance, in 2009, Chancellor Chandler dismissed a claim against the Citigroup Board for failure to monitor. The plaintiffs alleged a violation of the Board’s Caremark duty for failure to monitor risk in Citigroup’s subprime mortgage portfolio.¹¹⁸118.See In re Citigroup Inc. Shareholder Derivative Litig., 964 A.2d 106, 123–24 (Del. Ch. 2009). The court saw these claims as attempting to hold the directors liable for business decisions, and quickly dismissed the claim.¹¹⁹119.Id. at 124 (“When one looks past the lofty allegations of duties of oversight and red flags used to dress up these claims, what is left appears to be plaintiff shareholders attempting to hold the director defendants personally liable for making (or allowing to be made) business decisions that, in hindsight, turned out poorly for the Company.”).

Given the limited nature of the doctrine, Caremark may not create enough incentive for the board to retain in-house regulators in a deregulatory environment. However, to overcome a Caremark claim, directors “must make sure their risk oversight duties are met.”¹²⁰120.Brian J. McCarthy and Janisha Sabnani, Risk Governance Will Be the Talk in Corporate Boardrooms in 2010, S.F. Daily J. (Dec. 28, 2009). And directors familiar with only the presence of a duty to monitor, but not the fine gradations of the doctrine, will likely err on the side of additional monitoring and reporting to ensure compliance. As such, once a monitoring system is put into place, it may act as a one-way ratchet—the Board will be unlikely to remove the system because it fears that it may subject it to Caremark liability under the first doctrinal hook (failure to establish an adequate monitoring system). While these incentives may not be especially powerful, they present another avenue through which the board may encourage the maintenance of in-house regulators.

2. Reputation and External Reporting Pressures

Caremark’s oversight duty is not the only external pressure on boards and management to perpetuate regulatory staffs’ existence in a deregulatory environment. Just as internal actors rely on information produced by in-house regulators, external actors also rely on it. Privacy officers are responsible for producing and refining a firm’s privacy policy—a key document that the media and watchdog groups use to inform consumers.¹²¹121.See Bamberger & Mulligan, supra note 119. Similarly, hospitals are now able to provide more precise information to ratings organizations and potential donors.

Some legal regimes—like securities law—mandate disclosure. But there are non-legal explanations for revealing information. Reducing information asymmetry between management and the market reduces a firm’s cost of capital and enhances the liquidity of the firm’s securities.¹²²122.See generally Douglas W. Diamond & Robert E. Verrecchia, Disclosure, Liquidity, and the Cost of Capital, 46 J. Fin. 1325 (1991) (suggesting that decreasing the information asymmetry between investors and the firm can reduce the firm’s cost of capital). The release of information by one firm has two immediate effects. First, it pressures other firms to release similar information, else those interested will assume the worse. Second, it puts pressure on the firm to continue to disclose the information, else interested parties will assume nondisclosure reflects negatively on the firm.

Therefore, external reliance on information produced by in-house regulators can occur even absent a firm’s affirmative disclosure. Once one firm within an industry discloses, pressure on others will grow to disclose similar information.¹²³123.Prentice, supra note 75, at 780–81 (discussing how rational issuers will self-regulate disclosures because of reputational constraints). And if the information is dynamic—that is, it changes overtime—reliance interests will pressure the firm for continued reliance else a negative inference is drawn about the firm.

For example, bank equity analysts have started to drill down on capital and risk numbers in recent years. Because firms rely on the in-house regulators to supply these numbers, their value to management increases as external parties become more-and-more reliant on this information. Several financial firms have started to release forward guidance on their risk plans, and firms that did not have been chided by equity analysts.¹²⁴124.See, e.g., Analysts Grill Goldman CFO Over Lack of Leverage Ratio Detail, Reuters (July, 16, 2013, 8:15 AM), http://www.reuters.com/article/goldman-results-call-idUSL1N0FM0U920130716 (https://perma.cc/AG5D-CPCP). Irrespective of the regulatory environment, equity analysts strive to collect a full picture of the firm, which requires the information supplied by in-house regulators. Moreover, firms may have an incentive to disclose information to equity analysts, as those firms that disclose more tend to have higher returns, likely because investors’ expectations were appropriately calibrated.¹²⁵125.See Alexandra Niessen-Runzi, Jerry Parwarda & Stefan Rueniz, Information Effects of the Basel Bank Capital and Risk Pillar 3 Disclosures on Equity Analyst Research—An Exploratory Examination, CIFR Working Paper Series (Aug. 2015), https://papers.ssrn.com/sol3/papers.cfm?abstract_id=2670418 (https://perma.cc/8PU7-QJV3). Reliance by third parties on information supplied by in-house regulators can bolster the credibility, importance, and, ultimately, resilience of in-house regulators in a deregulatory environment.

3. The Revolving Door and the Human Capital Hypothesis

The revolving door may also connect prosecutorial discretion with firm regulatory staff entrenchment. The human capital hypothesis posits that future job prospects will motivate regulators to regulate aggressively to show off their expertise and talents. In a deregulatory administration, regulators may foresee their future job prospects thinning. The alternative revolving door hypothesis—the rent seeking hypothesis in which regulators attempt to curry favor with regulated firms by going easy on them—is no longer attractive to regulators. Lax enforcement will not translate into a job if deregulation occurs—the regulator’s expertise won’t be needed. As a result, deregulatory rhetoric may, at least in the short-run, lead to more aggressive enforcement. Although generally thought to be explained by resistance, the EPA’s increased enforcement of environmental regulations after Reagan became president may reveal that deregulatory rhetoric hones regulators to focus on their future prospects.¹²⁶126.See Wood, supra note 39, at 217–27.

This goes back to the earlier point that agency costs allow in-house regulators to overstate their value in a deregulatory environment through examples of ongoing regulation. But these examples, then, are not flukes—they are likely systematic in a deregulatory environment. In many ways, the rent-seeking is recursive. As regulation increases, the regulators may have mixed incentives and pursue either more aggressive regulation (the human capital thesis) or less aggressive regulation (the revolving door hypothesis). In any event, in-house regulators have an incentive to communicate that harshness of regulation (regardless of the regulator’s actions).¹²⁷127.See Donald C. Langevoort, Monitoring: The Behavioral Economics of Corporate Compliance With Law, 2002 Colum. Bus. L. Rev. 71, 83–90 (noting the difficulties managers have in monitoring compliance professionals). Therefore, in times of regulatory formation, the size and stature of in-house regulatory departments increases.

But then in deregulatory periods, regulators’ incentives change, and they are more likely to pursue aggressive regulation. The Wells Fargo example above might be an expected repercussion of deregulatory rhetoric, not an insolated, idiosyncratic example. In that case, in-house regulators have ready experiences to bring to bear on keeping their size (if not their stature). Although managers may observe deregulatory rhetoric, their inability to monitor in-house regulators (and the changed incentives of regulators) means that they may be more likely to defer.¹²⁸128.See id.

Again, this is not to say the persistence is infinite. Eventually, deregulation will become a reality and regulators will no longer be equipped with the tools to be aggressive (even if they are incentivized to be so). So, over time, in-house regulators will have less ammunition to fight off impending decreases in size and stature. The point, again, is not to posit infinite persistence but to show the time lag between rhetoric and on-the-ground change is burdened not just by administrative barriers but also by how those barriers can encourage and aid in-house regulators.

Future Regulatory Uncertainty

Regulated firms also face the possible return of regulation. Agencies need a commitment mechanism to regulate effectively into the future.¹²⁹129.See Jonathan Masur, Judicial Deference and the Credibility of Agency Commitments, 60 Vand. L. Rev. 1021, 1041–42 (2007). The same impulse may exist with deregulation. In the regulatory context, regulated entities use administrative processes, like notice and comment, and political pressure, through lobbying, to mitigate regulation’s impact.¹³⁰130.See Nielson, supra note 11. In anticipation of the regulation, firms have rewired their operations to conform ex ante.

This same dynamic may hedge against deregulation’s immediacy within firm. In the event regulation returns, firms want the ability to shape regulation. They can do this by maintaining some in-house regulators. New regulation generally looks to the private sector for models,¹³¹131.See David Zaring, Best Practices, 81 N.Y.U. L. Rev. 294, 304–05 (2006) (noting that scholars suggest agencies “look to the private sector for assistance with rule generation”). so when regulation reappears, regulated firms lobby to have the regulatory scheme fit their existing program. For this to work, they need some level of compliance—without any compliance, they will lack credibility in the face of regulatory pressures. As such, maintaining in-house regulators can be thought of as an affirmative future defense to the return of regulatory pressures.

Just as the revolving door may increase regulatory aggressiveness immediately following deregulatory rhetoric, future regulatory uncertainty may encourage firms to maintain regulatory staffs. Although presently in a deregulatory environment, firms know that they are just one election, appointment, or scandal away from regulation’s return. Swiftly returning to a regulatory environment requires experts, and firms may well want to maintain regulatory staff to hedge against the return of regulation. Their in-house regulators will be best positioned to take up the mantle of regulation, ensuring that the regulation isn’t too onerous, and they will understand the challenges firms actually face. Gutting in-house regulators in a deregulatory, but uncertain, environment depletes the firm’s regulatory expertise. In the event that expertise becomes valuable again, the underinvested firm will have to spend time and resources reacquiring this knowledge.

Moreover, uncertainty is, unexpectedly, stabilizing. Often, commentators talk about uncertainty as a drag on future investment—firms are loath to invest in the future if they cannot accurately anticipate future constraints or pressures on their operations. But the same force is at work in divesting. In an uncertain environment, removing regulatory staff is just as risky as hiring more regulatory staff.

Finally, in light of potential regulatory return, firm managers may fall into the sunk cost fallacy—the time and money spent on developing in-house regulators may make them averse to gutting the program at the hint of deregulation. Moreover, the cost of decreasing the program—severance, loss of knowledge, etc.—may future exacerbate this thinking. That is not to say it cannot be overcome; just that it creates a behavioral barrier that, in conjunction with other barriers, may exacerbate the tendency to retain in-house regulators.

***

Economic and sociological theory suggest that the response of regulated entities to deregulation will not be swift. If anything, it will be slow, plodding, and constrained by a host of internal and external forces. The effect on various companies and industries will depend on a variety of factors—firm size, the remaining regulatory burden, and the length of previous regulation, to name a few.

This evaluation does suggest regulation that causes firms to centralize and create internal and external dependencies on in-house regulators will be more persistent. Of course, deregulation may change the motivation and force of in-house regulations. For instance, as financial deregulation continues, risk managers will have less of a bludgeon to push back on risky trades—no longer will the regulatory mandate be a fait accompli to stop risky activity. But those same risk managers will continue to be present in the firm. Their participation in decision-making persists, and the new tools and processes developed to monitor and manage risk continue. Financial firms may get riskier in a deregulatory environment, but their internal structure may be less risky than in the pre-regulatory environment. In that way, regulation persists because of its impact on firm structure.

These theories may not operate simultaneously in all firms in all industries. But, from these theories, hypotheses can be formed and tested. Empirical analysis and case-study methods can help determine which pathways are most likely to make in-house regulators stick, and how those forces operate in different firms and industries. And these insights may impact how agencies conduct cost-benefit analysis, or suggest changes in regulatory design at both the congressional and agency level. Nevertheless, thinking about deregulatory inertia outside the administrative state paints a more realistic and multifaceted picture of how organization respond to the ebbs and flows of regulatory change.

Conclusion

Some may view this Essay’s predictions as positive—the persistence of regulation ensures ongoing safety and soundness in a deregulatory environment. Others may see the prediction as another argument against the administrative state. In any event, this Essay aims to be an opening salvo in thinking about regulatory persistence outside of the administrative state. As regulation increasingly becomes standards-based, the firms implementing the regulation become a key feature of the regulation, and must be a key feature of study to understand the effectiveness and persistence of regulatory arrangements.

Future research is, of course, needed to prove out the hypothesis that in-house regulators are “sticky.” Case studies of particular firms and industries will help expose which theories of persistence are more robust, and may highlight how firms have overcome the forces described by this Essay. But as we march through a period of deregulation, scholars should keep firms in their peripheral vision. Whether the parade of horribles some predict will result when deregulation manifests itself completely will be predicated, in part, on how firms respond. And if scholars and advocates can understand how firms adapt to deregulation, as well as regulation, they will be bettered positioned to craft regulation that is persistent regardless of administrative change.