Which of the following is the BEST way to validate that privacy practices align to the published enterprise privacy management program?