It truly is incumbent on the organization to demonstrate that they understand the requirement and can explain their approach. Unfortunately, they don't get enough help.
That’s where Elsmar can help beyond, perhaps, the processes for assuring competence.