I'm not sure what the distinction is between the two. Is one of those having a verified system to ensure that you are compliant, while the other is merely bein

I'm not sure what the distinction is between the two. Is one of those having a verified system to ensure that you are compliant, while the other is merely being compliant but unprovably so?