Organizations understand what regulators want but are struggling to demonstrate that they are delivering it.