A privacy officer at a multinational insurer has rolled out mandatory annual privacy awareness training to all employees. Twelve months later, senior management asks for evidence that the training is actually reducing privacy risk within the organization. Completion rates are consistently above 98%. Which of the following would BEST demonstrate the effectiveness of the privacy awareness program?