Inspections.

Observations.

Training.

Audits.

Verifications.

Actions.

All can be useful.

It doesn't automatically tell us whether risk changed.