The Compliance Paradox: Why Adding Controls Makes Regulated Organizations Slower to Adapt
An average community hospital dedicates 59 full-time employees to regulatory compliance. One-quarter of them are physicians, nurses, and clinicians — people trained to care for patients, reassigned to documentation. Across the sector, health systems spend nearly $39 billion a year on the administrative work of staying compliant, satisfying 629 discrete federal requirements drawn from four agencies. Those numbers come from the American Hospital Association's Regulatory Overload analysis, and every figure in them was, at some point, a reasonable decision. No one set out to build a $39 billion administrative apparatus. It accreted — one justified control at a time.
This is the compliance paradox. Each individual rule is defensible. The aggregate is an organization that can no longer move.
Leaders in regulated sectors — healthcare, financial services, pharmaceuticals, government — tend to treat control as a one-way ratchet. A failure occurs, so a procedure is added. An audit surfaces a gap, so an approval layer is inserted. Risk is the stated enemy, and more oversight feels like the obvious answer. The logic is sound for one class of problem and quietly corrosive for another. That distinction is the whole game.
Complicated problems reward control. Complex problems punish it.
A complicated problem is intricate but knowable. It has a correct answer that expert analysis and a well-built process can reach reliably — calculating a capital reserve, validating a clinical protocol, closing the books. For these, controls are exactly right. Standardization, checklists, and sign-offs convert hard-won expertise into repeatable performance. The more consequential the decision, the more a disciplined control earns its place.A "complex" problem is different in kind, not degree. It is fluid, interdependent, and shifting underneath you — a regulatory landscape rewriting itself across more than 100 bills in over 30 states, a technology that changes what compliance even means every eighteen months, a market that moves faster than your approval cycle. Complex problems have no stable correct answer, only better and worse responses that must keep adapting. And here, control accretion stops protecting the organization and starts taxing the one capacity it now depends on: the ability to adapt.
The cost of that tax is measurable. Gary Hamel and Michele Zanini, drawing on a survey of more than 7,000 Harvard Business Review readers, estimate that excess bureaucracy drains roughly $3 trillion a year from U.S. productivity. Two-thirds of respondents called bureaucracy a significant drag on the pace of decision-making — a figure that climbs toward 80% in large organizations. Only 20% said unconventional ideas were met with interest rather than resistance. Those are the symptoms of too much control, applied to the wrong kind of problem.
The risk that controls create
The deeper danger is that control accretion produces exactly the risk it was meant to eliminate. In healthcare, only 42% of compliance leaders say they are confident in their organization's ability to maintain a high quality of care — even as compliance spending climbs. The machinery built to protect quality now coincides with eroding confidence in it. That is not a coincidence; it is the paradox operating on schedule. Attention is finite. Every hour spent demonstrating defensibility is an hour not spent on the adaptive work that actually keeps an organization safe in a moving environment.
Control accretion also reshapes behavior in ways no compliance manual intends. In Hamel and Zanini's data, 76% of people in large organizations said bureaucratic skill — navigating the rules, not serving the mission — was the decisive factor in who gets ahead. When the surest path to advancement runs through procedural fluency rather than judgment, an organization is training its most capable people to optimize for defensibility over responsiveness. The culture adapts to the controls. The market does not wait for it.
Recognizing the threshold
Governments are beginning to name the problem directly. In Puerto Rico, Executive Order OE-2025-009, signed February 4, 2025, by Governor Jenniffer A. González Colón, mandates a sweeping revision, simplification, and digitization of government structures and processes — an explicit acknowledgment that proceduralization itself had become the obstacle to serving citizens. The instinct behind that order applies far beyond government. Every regulated organization eventually reaches a threshold where the next control subtracts more adaptive capacity than it adds protection.
The strategic move is not to swing from "more control" to "less control." That framing is the trap — it treats control as a single dial when it is really a portfolio. The move is to audit your controls by the kind of problem each one addresses. Which controls govern truly complicated, knowable risks where a rule produces reliable performance? Keep those, and sharpen them. Which controls are attempts to manage a complex, shifting reality through static procedure — a rule standing in for the judgment and real-time adaptation the situation actually demands? Those are the ones quietly draining your capacity to respond, and they are the candidates for redesign.
Adaptive capacity is not the opposite of good governance. It is a governable asset in its own right — one that most regulated organizations measure nowhere, defend by no one, and lose one reasonable control at a time. The organizations that will thrive in complexity are not the ones with the fewest rules or the most. They are the ones that know, control by control, which problem they are actually solving.
Helping regulated organizations stay adaptive without breaking compliance is exactly the kind of complexity we work in — how we work · contact.
Sources: American Hospital Association & Manatt Health, “Regulatory Overload” (2017); Hamel & Zanini, “The $3 Trillion Prize for Busting Bureaucracy”; Puerto Rico Executive Order OE-2025-009 (2025).
