[watwut]

Proactive audit system seems to be better one to me. It is more predictable - you know in advance which rules you are supposed to follow. It also allows for widely accepted risk standard know in advance to both customers and providers.

The "do what you want and we will punish you hard if luck strikes badly" is less predictable. It has unfair results. It leads to both excessive risk avoidance (because if you are unlucky punishment is disproportionate) and risk taking customer is unable to proactively avoid.