"I'm pretty sure I saw an alert about that" is not a legal strategy. In a 2026 audit, you either have a defensible record of regulatory monitoring — or you don't.