After years under the tutelage of prescriptive rules and audits it is no wonder that the question of what and how to improve compliance is met with:
we are fully compliant,
there is nothing to improve, and
we have someone that does that.
However, to meet performance and outcome-based obligations this question is met with a different answer:
we are making progress towards targeted outcomes,
we are continuously advancing our capabilities to reduce risk, and
our entire company is committed to and engaged in this process.
It's time for a new mindset if compliance wants to see new and better results.