> They left the back door open for two months. There's a difference between "left the back door open for two months" and "the back door was open for two months

> They left the back door open for two months. There's a difference between "left the back door open for two months" and "the back door was open for two months because the person assigned to verify it was closed told everyone it was". > If "good written procedures" weren't followed, what good is that? How do you know they aren't being followed? How many layers are enough? If a process breaks down, what's your first signal? > allowing every freaking company to police itself. CRAs don't police themselves, they're audited and regulated already.