leadership information define sap industry business requirements global security policies drive assessments remediation network control controls sas standards assess reports initiatives compliance audit recommendations regulatory training offshore possess findings risk ncua delivered mars organization organizations