Ask most HR, WHS or Risk leaders how confident they are in their organisation’s compliance and governance systems and the honest answer is often “reasonably confident — but I couldn’t prove it if a regulator or board member asked me to”.