Applying Policy in Practice: Compliance, Reporting, and Risk Mitigation