Licensing and Permitting

Principle 2: Keep L&P proportionate to risks

 

Principle definition
The use of L&P processes and their requirements should be limited to cases where activities cannot be regulated effectively ex post and be tailored to the level of risk a business faces or an activity poses. It should only be applied when the potential impact is significant and irreversible, meaning the damage cannot be easily undone.
Sub-principles	Criteria
2.1 Limit the use of L&P based on risk	Choose L&P only when risks cannot be managed effectively any other way Focus L&P on managing risks rather than to raise revenue or enforce rules
2.2 Assess risks before choosing L&P tools	Evaluate the risks of an activity or business before selecting an L&P tool
2.3 Prioritise risk management in L&P decisions	Manage risks for a more targeted L&P to reduce burdens and more efficiently use public resources Move from an “ex ante” to an “ex post” approach to better manage risks Manage risks in cases of uncertainty Evaluate and balance risk trade-offs to determine which risks really need to be mitigated Accept risks as part of risk management
2.4 Communicate risks clearly	Make communication of risk a core task under risk management in L&P

A risk-based approach to L&P enhances regulatory efficiency by focusing efforts where they are most needed. L&Ps without risk-proportionate requirements can be burdensome, costly, and complex to fulfil. When used excessively, L&Ps can negatively impact both public administration and businesses.

L&Ps should be used only when strictly necessary. They should be used when activities are high risk and ex ante conditions and safeguards are essential for risk mitigation. These include cases where probability of serious harm is high, where the potential harm would be significant and irreversible, and risks need to be managed even before the start of operations.

A graded regulatory response and one which is proportionate to the level of risk posed by a business or activity should be considered. When probability of harm is low or where any potential harm is reversible or low impact, alternative options to “strict” or “full” L&P, including L&P with fewer requirements, notifications or reporting requirements, can be effective.

Periodic risk assessment is crucial to ensure that L&P achieve their intended goals while allowing for complimentary approaches when needed. This approach supports both businesses and public administration by enabling evidence-based decision making, while also improving risk clarity for all stakeholders.

A risk-based approach also helps balance regulatory benefits, such as enhanced safety and environmental protection, against compliance costs for businesses. By addressing procedural complexity, it allows low-risk activities to proceed without unnecessary regulatory burdens. Ultimately, this approach can promote economic growth, facilitate trade and enhance certainty in the regulatory system.

2.1. Limit the use of L&P based on risk

Choose L&P only when risks cannot be managed effectively any other way. Identifying risks that can only be mitigated through L&P is crucial for ensuring that regulatory measures are applied effectively. L&P can be considered when managing significant safety risks that need to be mitigated ex ante for public interest (OECD, 2023[11]).

Risk assessments allow for a graded response to balancing risk trade-offs. These trade-offs can involve critical value choices and typically include public safety, environmental protection, competition, compliance costs, and delays in industrial development and technological roll-out. In some cases, L&P may be needed to ensure fair allocation of scarce resources, such as radio frequencies in telecommunications and extraction rights for rare minerals.

When justified by risk-assessments, L&Ps can be chosen. L&P can be warranted especially when potential harms are irreversible such as permanent contamination or biodiversity loss. Even when L&P is chosen as the appropriate tool, its requirements should be proportionate to the risk being addressed and trade-offs should be balanced as far as practicable. In other cases where hazards are well-known and/or the probability and intensity of harm is low, less burdensome regulatory tools should be considered.

Proportionate approaches ensure risks are mitigated, businesses are not unnecessarily burdened, and licensing authorities are still able to monitor activity, and collect data. Graded responses could include third party certifications, notifications or self-declarations (see Figure 2.1). Notifications are less burdensome as they require complying with less administrative requirements and yet still allow authorities to collect information about the businesses involved.

Figure 2.1. Illustration of a risk-proportionate approach to L&P

Source: Author’s own elaboration.

L&Ps with formalistic or disproportionate requirements can impose significant burdens on businesses, requiring them to conduct expert evaluations or navigate complex application processes to secure a license or permit. For example, an energy operator seeking an environmental license may need to provide an environment impact assessment, technical data on emissions, spatial permits and other formal documentation. These time- and resource-intensive procedures can be excessive relative to the actual risks posed by the business or activity.

In cases where risks are well understood or where safety risks and mitigation measures are well established, L&P with lighter requirements should be considered. Regulators can also apply the “silence is consent” principle – where approval is automatically granted if no decision is made within a set timeframe – to ensure that regulatory indecision does not lead to delays. Allowing businesses to begin operations with ex post monitoring can streamline processes, but regulatory oversight remains essential to ensure compliance. Periodic assessments can help regulators evaluate the effectiveness of this approach and make necessary adjustments.

A risk proportionate approach can also help to improve the business environment and enhance trust between the licensing authority and the business. This is because a risk-based approach to licensing can justify the circumstances of tight regulatory control and reverse the burden of proof. As such, it is up to the public authority to justify licensing as the appropriate risk-management strategy. This shifts away from the business the burden to prove that its activities are low risk.

Focus L&P on managing risks rather than raising revenue or collecting information. A crucial governance issue is that licences and permits are sometimes relied on by authorities not so much as instruments to manage public risks, but for other effects, such as generating revenue or keeping track of business operators active in a given regulatory field.

Using L&P for this purpose, when prior approval is neither necessary for risk mitigation nor appropriate, creates major negative economic and social effects. It reduces trust in the administration because regulatory decisions are not evidence based. In the long run, it also increases costs for the public administration as resources are not used efficiently or in regulatory activities that are high risk.

Revenue generation, and information about businesses should not be the motivation behind L&P. Revenue for public services should be generated from other channels. While data and information on businesses are important for risk-based decision making, they should be accurate, updated and should be collected from other sources. L&Ps which are risk justified can still be used as a source of data but should not be the only or primary source.

2.2. Assess risks before choosing L&P tools

Evaluate the risks of an activity or business before selecting an L&P tool. Deciding on the appropriate type and intensity of the regulatory response requires a comparison and understanding of the relative levels of different risks, both in terms of combined probability and severity of harm (OECD, 2021[13]). A structured and transparent approach to risk characterisation should assess both adverse consequences and their potential, considering factors like magnitude and reversibility of potential harms.

Box 2.1. Defining risk

Risk is the probability of a hazard (source of harm) causing harm, where the harm caused is categorised by its magnitude and severity. For example, a factory that uses flammable gases (hazard) can pose risks like fires or explosions (harm), which may be very likely without safety measures, but much less likely if proper precautions are taken. From a regulatory perspective, risk (specifically public risk) indicates the probability and extent of the negative impact on the environment and population from an adverse event. Risk evaluation therefore requires an analysis of the activity from two perspectives – the severity of the harm in question, and the likelihood of the harm occurring.

Source: (OECD, 2023[11]), Risk-based Regulatory Design for the Safe Use of Hydrogen, OECD Publishing, Paris, https://doi.org/10.1787/46d2da5e-en.

Employing multi-criteria analysis (MCA) can help assess and compare different risk factors and L&P options. An MCA allows for risk consideration through different dimensions (industrial activity, biodiversity loss, climate change and innovation).

Evaluation of risks normally involves categorising the risks for a given harm on a scale from very high to very low. For instance, in the case of occupational health and safety, light injury would typically fall under a low-risk category as opposed to activities that may result in fatalities, which would be categorised as high risk. Once risk categorisation is complete, the next step is to assess the probability and frequency of the riskiest activity – i.e. the likelihood of harm. For instance, if an accident resulting in fatalities is highly unlikely, then despite its severe consequences, the activity may still not be classified as high-risk.

Box 2.2. Risk categorisation for effective decision-making

Figure 2.2. Risk matrix representing action areas depending on type of consequence (harm) and probability

Source: Author’s own elaboration. The above risk matrix should serve as general guidance for categorising risk into categories of low, medium and high risk. Other layers can be considered and added depending on the activity or technology which needs to be regulated.

By using risk ratings and risk matrices, regulators can identify those activities that require L&P as the appropriate regulatory tool. Risk rating, i.e. the risk of a particular business or activity, can be affected by various factors; these may be related to size, location, type of technology, number of people impacted, past compliance, and the extent of human interference. These factors can be represented through concise risk matrices.

A good risk management model helps assess the various dimensions affecting a business and can ensure evidence-based decision-making that is backed by quality data and is outcome-driven. A risk‑based system can also prompt regulators to co-operate with each other through the exchange of data used for risk modelling, making data a key element of risk-based decision-making.

By using dynamic risk criteria (e.g. previous compliance, real-time monitoring of environmental conditions, emerging technological risks, or changes in market behaviour or business model) in addition to static ones (e.g., inherent hazard classifications, or fixed industry standards, size, location), authorities can account for evolving contexts and ensure that risk assessments remain relevant over time. This adaptability allows for timely adjustments to risk ratings and matrices, helping to refine L&P requirements as new information emerges and circumstances change.

Source: (OECD, 2018[3]), OECD Regulatory Enforcement and Inspections Toolkit, OECD Publishing, Paris, https://doi.org/10.1787/9789264303959-en.

Once the different risk factors are identified, they can be prioritised based on existing legal requirements and public interest. Since regulatory sectors vary, risk evaluation criteria should always be tailored to the business, activity, or products under consideration.

2.3. Prioritise risk management in L&P decisions

Manage risks for a more targeted L&P to reduce burdens and more efficiently use public resources. Risk management has an important role to play in broader regulatory delivery. When it is part of the regulatory culture, risk management supports the functioning and co-operation between L&P authorities and inspections and enforcement authorities. It makes verification and monitoring of compliance more targeted with regulatory resources focused on high-risk targets rather than every business or activity.

Move from an “ex ante” to an “ex post” approach to better manage risks.  Risks are better managed and greater regulatory compliance is achieved when regulatory enforcement and inspections are applied to ongoing operations, rather than through prior, pre-activity approvals and requirements (see Box 2.3). This is further relevant as individuals and businesses create risks when they act or operate. For example, a chemical manufacturing plant that is regularly inspected and monitored by regulatory authorities tends to maintain better safety practices and compliance with regulations than a plant that only had to meet pre-approval requirements before starting operations.

If verification through inspections or supervision can be carried out later (ex post phase), without endangering the public interest, then no action or requirement is needed at the ex ante phase. While ex ante approaches can only specify the conditions that a business operator must follow, they do not assess the actual, in-use phase of those conditions. This can be best done through ex post checks.

Box 2.3. Considerations for ex ante control in L&P

Is ex ante control a necessary, adequate, effective way to achieve outcomes?

• Are the risks posed by the activity of such a nature that the damage they may cause would be irreversible – or at least cost drastically more to repair or remediate than they would cost to prevent? If so, an ex ante regulatory instrument may be warranted, but if not, then ex post regulation is likely to be sufficient.

• Are the risks posed by the activity primarily related to issues that can be detected and appraised ex ante – for instance the structure or accessibility and layout of a building, the way an equipment is installed, the appropriate qualification of key personnel? If so, ex ante regulatory instruments may be effective. But if the risks would primarily arise from processes and practices, such regulatory instruments will be inadequate, and the focus should be on effective inspections, enforcement, and awareness raising.

• Does the activity involve the use of limited or scarce resources which would justify the use of an ex ante instrument? Ex ante controls could become necessary in situations where the government has to adjudicate access to scarce resources such as minerals, airwaves, etc.

Source: (World Bank Group, forthcoming[14]), Technical guidelines on risk-based approaches to business licensing, and recommendations for Viet Nam’s tourism accommodation sector, International Bank for Reconstruction and Development.

Once the risk assessment phase is complete, identify appropriate mitigation measures that do not impose unnecessary burdens on businesses (European Regulation and Innovation Forum, 2022[15]).

Manage risks in cases of uncertainty. Regulators often need to decide the permitting of activities where hazards are unknown and scientific evidence on the probability or magnitude of harm is uncertain. In these scenarios, the activity in question can still be carried out, but with proportionate safety requirements depending on available assessments. This approach is preferred to the “doing nothing” and “over regulating” approach (OECD, 2023[16]). It allows for better balancing between safety issues and potential benefits.

This approach should be applied for emerging technologies or business activities when there is significant scientific uncertainty about the potential risks these technologies may pose to health, safety, or the environment. In such cases, decision-makers should choose interventions to prevent harms from occurring It is an approach which requires imposing risk mitigation measures, because the full extent of the risk is not yet clear. This could involve setting stricter conditions for operation, requiring continuous monitoring and assessment, or implementing adaptive management strategies that allow for adjustments as more information becomes available.

For licensing authorities that face multiple conflicting risks, this approach can be used to manage risk trade-offs, regulate for better outcomes, and follow a more proportionate approach to risk mitigation. Once more evidence and certainty about the technology’s safety becomes available, conventional risk management tools should be considered. The goal is to ensure that innovation can proceed while safeguarding public and environmental health, particularly in areas where the potential consequences of inaction could be severe or irreversible.

Evaluate and balance risk trade-offs to determine which risks really need to be mitigated. When considering decision-making under uncertainty, it is also important to evaluate the various risk trade-offs. As is often the case, regulating one risk can impose other risks elsewhere. For instance, safety risks and measures, for example for renewable energy technologies such as hydrogen, should be weighed against their potential benefits, such as a reduction in climate change-related risks (OECD, 2023[11]). Allowing new technologies with risk-proportionate safeguards can also help mitigate risks related to the continuous burning of fossil fuels. Such decision making requires considering both immediate and long-term risks, wherein some risks are more diffuse or uncertain (OECD, 2023[16]).

Accept risks as part of risk management. There is no such thing as the complete absence of risk. In many cases, defining tolerable limits of acceptable risk can be a complex task. This may be due to the unknown nature of a new technology or activity. A proportionate approach to risk management allows for the identification and balancing of different risks based on the available scientific data. Risks should be regularly reviewed as new information becomes available, and other risk management options should be considered, even if L&P was initially chosen as the best way to manage the risks (OECD, 2021[13]).

2.4. Communicate risks clearly

Make communication of risk a core task of risk management in L&P. Risk perception, i.e. the way society, individuals and businesses, and licensing authorities perceive safety, harm and mitigation measures, can have an impact on the way risk is managed. Some societies may be inherently more risk-averse than others. This may be due to a variety of reasons, including a shortage of technology specific skills, a general culture of excessive caution, and uncertainty around a technology.

Governments and licensing authorities must be able to communicate to the public a suitable level of knowledge and safety information in a manner that is simple and transparent. They should use clear, concise and understandable language to explain risks and trade-offs and address public concerns. They should also leverage the most suitable channels and formats for communicating and providing access to L&P processes. Communication strategies can benefit from inter-governmental co-operation and collaboration as well as systematic collection of data. Informatics from such co-operation can be presented to local authorities for further dissemination to communities as well as to improve confidence amongst L&P authorities.

Public awareness and transparent communication are key to fostering trust in regulatory decision making and bringing more certainty for businesses and affected communities. Central authorities should assist local governments in implementing educational campaigns and clear communication strategies to clarify risks. Communication campaigns should also clarify the trade-offs involved in risk management. For example, when explaining the risks of hydrogen, both its safety concerns and its potential long-term advantages over fossil fuels should be communicated. Additionally, such campaigns can encourage evidence-based comparisons of safety records across different energy sectors. In this context, shifting risk perceptions requires highlighting the broader environmental and health benefits of transitioning away from fossil fuels, framing it as a safer choice for society.