If you can’t systematically track your own controls, tracking third-party data access is even less likely.