The creation of annual plans driven by once-a-year risk assessments is no longer an effective compliance road map