A financial institution (FI) has decided to revamp its compliance program to be more risk-based. Which option should the FI use as part of the new risk-based co...