I disagree. Compliance enforcement of complex systems is not done by sending in a team of engineers to reverse engineer the whole thing. What you do is require

I disagree. Compliance enforcement of complex systems is not done by sending in a team of engineers to reverse engineer the whole thing. What you do is require the regulated corporation to maintain auditable evidence of its compliance in a specific format, then do routine auditing of the evidence. You only do a true deep dive into their systems if the routine audit shows non-compliance or potential fraud.