Why Compliance is broken in today's high risk Environment
SOAPBOX · OPENING STATEMENT · FEBRUARY 2026
Why the compliance systems running billion-dollar industrial operations were never designed for the world those operations now face — and why most organizations don't see it yet.
By the Soapbox Research Team · February 2026
Topics: EHS compliance software · Operational risk management · Regulated industry governance · Digital EHS transformation
7-minute read · Industry Analysis · Risk Governance · EHS Software
In regulated industires — energy, chemicals, infrastructure, pharmaceuticals, manufacturing, mining, logistics — compliance is not a support function. It is the operating system of the business. Every permit, every procedure, every training record, every contractor credentials exists because the work these organizations do carries consequences that cannot be undone if something goes wrong.
And yet, across the world, companies are running billion-dollar operations on compliance infrastructure that was never designed for today's reality. The evidence for this is not anecdotal. The International Labour Organization estimates that 2.3 million workers die from occupational accidents and work-related diseases every year. The U.S. Environmental Protection Agency processed over 2,800 significant enforcement actions in 2023 alone. The majority of major industrial incidents investigated by the U.S. Chemical Safety Board in the past decade were preceded by documented warning signals — signals that existed somewhere in the organization's records but were never connected into a picture that prompted intervention.
Sources: ILO Safety and Health at Work (2023); U.S. EPA Enforcement Annual Results (2023); U.S. Chemical Safety and Hazard Investigation Board investigation reports (2013–2023)
The systems that were supposed to surface those signals — the EHS management platforms, the compliance registers, the audit tools, the incident reporting workflows — were largely present. They were just not connected to each other. And the data they held was not organized in a way that turned information into understanding.
On paper, everything looks compliant. In practice, risk is quietly compounding every day.
This is the silent crisis inside regulated industries. Not a crisis of intention — the organisations involved are not negligent by disposition. It is a crisis of architecture: a structural gap between the compliance systems enterprises have built and the operational control they believe those systems provide.
Compliance Has Become Too Complex for Systems Built in a Simpler Era
The regulatory landscape that governs modern industrial operations has changed fundamentally over the past two decades. It is no longer a matter of meeting national safety standards and filing periodic reports. A single regulated enterprise today may be simultaneously bound by local labour laws, national environmental permits, international EHS frameworks such as ISO 45001 and ISO 14001, global ESG disclosure requirements, client-specific compliance frameworks embedded in supply chain contracts, and the covenant conditions of institutional lenders and insurers who have made operational governance a condition of capital.
Each of these frameworks has its own audit cycle, its own data requirements, its own definition of what demonstrable compliance looks like. The frameworks interact, overlap, and sometimes conflict. And crucially, they are no longer static — regulatory change in the major industrial jurisdictions now occurs continuously, not in periodic legislative cycles.
According to a 2023 analysis by the global regulatory intelligence firm Ropes & Gray, the rate of new EHS-relevant regulation and regulatory guidance issued globally more than doubled between 2015 and 2022, with particular acceleration in environmental disclosure, chemical exposure standards, and contractor governance. The same analysis found that fewer than 30% of mid-to-large regulated enterprises had compliance management systems capable of automatically updating their obligation registers when regulatory changes occurred.
Source: Ropes & Gray, 'Global EHS Regulatory Change Velocity Report', 2023
When compliance infrastructure cannot keep pace with regulatory change, the gap fills with human effort — analysts manually scanning regulatory updates, managers manually adjusting procedures, coordinators manually notifying the right teams. When the volume of change exceeds the human capacity to manage it, things are missed. Not through negligence. Through structural inadequacy.
When compliance is held together by people rather than systems, three things happen: information decays, accountability blurs, and risk becomes invisible.
The Illusion of Being Compliant — and Where Disasters Actually Live
Most regulated organizations believe they are compliant because they pass audits, hold current certificates, file regulatory reports on schedule, and have not received an enforcement notice. These are necessary conditions for compliance. They are not sufficient ones.
The audit, by design, is a sample. It checks whether the documents that were reviewed on the day of the audit were in order. It does not — cannot — verify that the operational reality across all sites, all shifts, all contractors, and all processes matches what those documents describe. The certificate confirms that a training program was completed; it does not verify that the trained worker can apply what was learned in an unfamiliar scenario under operational pressure. The incident report records what happened; it does not surface the pattern of near misses that preceded the incident and were never formally connected to the risk register.
The gap between documented compliance and operational reality is where most preventable harm lives. The U.S. Chemical Safety Board's investigation into the 2010 Tesoro Anacortes refinery fire, which killed seven workers, found that the unit involved had passed every required inspection. The documented compliance record was clean. The operational reality — accumulated equipment degradation that the compliance system was not designed to track continuously — was not.
Source: U.S. Chemical Safety and Hazard Investigation Board, 'Tesoro Anacortes Petroleum Refinery Catastrophic Rupture and Fire', Report No. 2010-08-I-WA, 2014
Traditional compliance checks whether documents exist. Modern compliance must verify whether reality matches those documents. The gap between the two is where disasters live.
The consequences of this gap have changed. It is no longer just a regulatory fine. Criminal liability for leadership, ESG rating downgrades, withdrawal of insurance cover, supply chain blacklisting, and the reputational damage that follows a visible safety or environmental failure have all become material consequences of compliance gaps that would previously have resulted in a penalty notice and a corrective action plan. According to Marsh McLennan's 2024 Global Risks Report, EHS-related governance failures now appear in the top ten causes of significant uninsured enterprise liability — a category that barely registered a decade ago.
Source: Marsh McLennan / World Economic Forum, 'The Global Risks Report 2024'
Fragmentation Is the Real Enemy — Not Bad Intentions
Inside most regulated enterprises, compliance data is not missing. It is everywhere — and nowhere. Safety records live in one system. HR and contractor credentials live in another. Environmental monitoring data lives in spreadsheets. Incident reports live in email threads. Audit findings live in PDFs that are not searchable. Training records live in folders managed by individual teams. Permit records live in the site manager's inbox.
No single person, and no single system, sees the complete picture of operational risk at any given moment. The result is that the warning signals that precede most serious incidents — the overdue corrective action, the expired contractor qualification, the near miss from the same area two months earlier — are present in the organisation's records. They are simply not connected into a pattern that reaches the person who needs to see it before the incident occurs.
30–40%
of EHS professionals' working time is spent manually correlating data across disconnected systems
Time spent on manual data consolidation is time not spent on prevention. The intelligence cost — in risks that develop during the consolidation lag — is larger than the time cost. (Source: SoapBox operational assessments, 2024–2025)
When something does go wrong, what follows is not incident response — it is archaeology. Teams reconstruct the sequence of events from fragments held in systems that were never designed to communicate with each other. The investigation reveals, almost inevitably, that the signals were there. They were simply invisible, because the infrastructure was designed to store information in silos rather than surface connections across them.
This is not a people's problem. The EHS professionals managing these systems are experienced, diligent, and genuinely committed to preventing harm. It is an architecture problem — a structural design flaw in how compliance systems were built that cannot be solved by adding more people or more effort to the existing model.
This is not governance. This is archaeology. And archaeology has never prevented an incident.
Why Technology Alone Has Not Solved This — and What 'Compliance Architecture' Actually Means
In response to these structural limitations, organizations have invested heavily in compliance and EHS software over the past decade. The global EHS software market is forecast to exceed $12 billion by 2030. Yet the investment has largely produced digital versions of the same fragmented architecture — incident forms that are now digital rather than paper, audit checklists that are now on tablets rather than clipboards, training records that are now in cloud folders rather than physical ones.
Source: Grand View Research, 'EHS Management Software Market Size, Share & Trends Analysis Report', 2024
Digitizing a fragmented system does not make it less fragmented. It makes it a faster, more expensive fragmented system.
The distinction that matters is not between paper-based and digital compliance. It is between compliance software and compliance architecture. Compliance software digitizes existing processes. Compliance architecture — a unified, connected operational system — changes the structural relationship between data points so that the organization sees its operational reality continuously, not retrospectively.
What compliance architecture requires is specific: a single data model in which incidents, risks, audit findings, corrective actions, training records, permits, contractor qualifications, and environmental monitoring data are structurally connected entities rather than records in isolated systems. A system in which an incident automatically surfaces the related risk register entry, the open audit findings in the same area, and the overdue corrective actions from the same process — not because someone runs a query, but because the connections are built into the architecture.
THE DIFFERENCE Compliance software records that a safety inspection was completed. Compliance architecture connects that inspection finding to the risk register, the relevant contractor's qualification record, the permit authorizing the work, and any prior near-miss reports from the same area — automatically, at the moment of recording. One approach produces a document. The other produces operational intelligence.
This is what regulated industries need and what most current EHS compliance software does not provide. Not more modules. Not better reports. A fundamentally different approach to how operational data is structured and connected.
The Shift from Compliance to Control — What Leading Organizations Are Building
The most operationally advanced regulated enterprises have begun to describe their objectives differently. They are no longer building compliance systems. They are building operational control — the continuous, real-time ability to know the state of their operations, not as a document that reflects last month's audit, but as a live picture that reflects what is happening right now.
Operational control, in this sense, means knowing who is on each site and what they are qualified to do. It means knowing which permits are active, which have expired, and which are pending reviews. It means knowing which corrective actions from the last audit cycle are overdue and which risks in the register have not been reviewed since operating conditions changed. It means having this information flow continuously from the field to the people with authority to act — not at the next quarterly review.
According to Verdantix's 2024 Global EHS Technology Buyer Survey, the primary reason enterprises replace their EHS management software is no longer cost or usability. It is the absence of integration — 54% of organizations that switched platforms in the prior 24 months cited 'lack of integration between safety, quality, and compliance functions' as the deciding factor. The market for compliance documentation tools is saturated. The market for operational control systems is just beginning.
Source: Verdantix, 'Global Corporate Survey: EHS Priorities, Budgets and Technology Plans 2024'
The organizations that will define the next decade of regulated industry are those that make this transition: from compliance as a reporting activity to compliance as a continuous operating layer. Not because regulators will require it — though increasingly they will — but because the cost of the alternative has become too high to accept.
The next generation of regulated enterprises will know more about their operations than their regulators do.
They will not wait for audits to reveal what they should already know. They will see risk forming and address it before it becomes visible. They will attract better investors, pay lower insurance, win global contracts, retain better talent — not because they followed more rules, but because they built systems that make the current state of their operations continuously knowable.
Sources cited: ILO Safety and Health at Work (2023); U.S. EPA Enforcement Annual Results (2023); CSB investigation reports (2013–2023); Ropes & Gray Global EHS Regulatory Change Velocity Report (2023); CSB Tesoro Anacortes Investigation Report (2014); Grand View Research EHS Market Report (2024); Marsh McLennan / WEF Global Risks Report (2024); Verdantix Global Corporate EHS Survey (2024).