Quiz: Turning Regulatory Duties Into Testable Controls