High-quality regulatory regimes are ones where bare-minimum checkbox-driven compliance yields good-enough results. Low-quality ones resemble kabuki, which I've personally witnessed in companies doing PCI self-certification.