Traditional compliance monitoring is characterised by annual assessments and reactive responses to incidents. While this approach is sufficient for simpler regulatory