the pros and cons of rule-compliance versus risk management is continuously debated,and defining how the roles in safety and security management should be distributed between the state and the industry is one of the most complex questions regarding risk regulation