Or better yet, if resources permit, have the IA department perform the actual compliance reivews - just call them compliance audits. That's what I do here and the examiners are pleased with the process.
_________________________
With the lights out, it's less dangerous.