Risk-management and rule-compliance are inter-related strategies for promoting safety in hazardous industries. For non-operational decisions, such as investment and design decisions, the need to convert risk-management into rule-compliance is equally important. Authorities have shown that they are willing to impose prescriptive technical rules on duty holders in relation to non-operational decisions, in the interests of safety. These points are illustrated using the BP Texas City accident, the Buncefield accident, and the Australian pipeline standard.