management commitment, risk assessment, internal controls, testing/auditing, training — provides the benchmark against which regulators assess sanctions compliance programs.