First, I think departments and regulators generally don't do well with outcome- or risk-based regulation. They like prescriptive, command and control. They'll prescribe how somebody will meet the outcome, and I think payroll and CRA-type taxes are an exact example of that, especially when it comes to money issues.
Where some departments that are trying to keep up with evolving technology or markets are having some success, it's my understanding that they need to accept more risk-based regulations that actually just focus on the highest areas of potential non-compliance.