Isn't that why there is an audit process? Audits are a tool to ensure compliance with a stochastic threat due to high cost of research and enforcement. For things they can check automatically they already do, but audits can find more detailed things, at a higher cost to carry out.