Regulators, as well as legal and compliance professionals, recently have shown increasing enthusiasm for risk-based methods. There is real value in these regulatory methods. Nonetheless, as with any human endeavor, if these methods are used without care, they could prove hazardous. The recent experience of the Transportation Security Administration (TSA) provides a cautionary tale.
Anyone who travels by air in the United States is familiar with TSA’s work. TSA has primary responsibility for securing the civil aviation system, including screening passengers and property transported by commercial aircraft. In fact, most citizens, including the author of this column, probably have more contact with TSA than with any other federal agency. In recent years, like many other agencies, TSA made a fundamental shift from one-size-fits-all methods to what TSA administrator John Pistole has described as a “risk-based, intelligence-driven security” approach. This involved several initiatives, including, most relevant to our discussion, a risk-assessment program called Screening of Passengers by Observation Techniques, or SPOT. See TSA Administrator John S. Pistole, CSIS: Evolution of Airport Security Since 9/11.
