Which of the following is the BEST approach to identify noncompliance issues with legal, regulatory, and contractual requirements?