How do you prioritize compliance work when you have limited resources?