In these compliance models the possibility of entities breaking a law has both a likelihood of occurrence and a consequence of occurrence, known as a 'risk event'. Considering entities' likelihood of not complying and the consequences of their not complying usually provides a 'power distribution'See for example "Power laws, Pareto distributions and Zipf's law" by M. Newman, 2006 @ https://arxiv.org/abs/cond-mat/0412004v3 of a few large consequence or higher likelihood clients and many more lower consequence/likelihood ones.
