I work in a highly regulated industry (banking), and I can tell you from first-hand experience that regulations like this that basically amount to 3rd-party licensed verification and auditing don't really stop bad things from happening, or the company at-large (especially the larger and more complex it becomes) from activities that years later end up as non-compliance issues, only for the company to get served a fine that is basically "the cost of doing business".