How do regulators audit risk assessments?