Regulatory risk and the changing compliance landscape. Is showing you're trying good enough?