“We were able to step back, look at our risks properly, and put structure around things that had previously felt messy. It made a big difference to how we now approach compliance.”