Turn a regulator request into tracked work: answer every question, substantiate each answer with a real control, test, change or incident, and track every commitment made to a due date.