I commend your organization: by following some good practices when it comes to data collection and storage it's already very far into the process of being GDPR

I commend your organization: by following some good practices when it comes to data collection and storage it's already very far into the process of being GDPR compliant, it looks like all you all are missing is the documenting it part of it where the processes are clearly defined and nominating someone to be the data protection officer. He was asking in general however, without a mechanism to control that corporations are doing what yours is already doing, how would we verify compliance?