Through a combination of quantitative metrics (SAR filing rate, false positive rate) and qualitative assessments (audit findings, staff competency, regulatory feedback, and successful defense against known typologies).