Showing results beats asserting privilege with compliance audits, experts say