You also do random audits, to check that the targeting follows the actual risk.