Compliance by design

An approach in which compliance is built into the system design rather than verified afterwards through audit. It is the logic underpinning governance by design: make violation difficult and leave automatic evidence when it occurs.

The alternative — checking afterwards by sampling — carries two costs: it finds breaches once they have happened, and only the ones that fall in the sample. Building it into the design changes both at once.