> No and no. The goal of regulatory compliance is to avoid liability But the way you avoid liability in this scenario is by implementing controls that reduce r

> No and no. The goal of regulatory compliance is to avoid liability But the way you avoid liability in this scenario is by implementing controls that reduce risk. You can fudge the audit if you want to. But for most regulated industries, if you have a major incident, you’ll have an investigation. If that finds your controls actually weren’t in place effectively, you can lose that protection, regardless of the outcome of the audit. The PCI SSC will tell you that a merchant that has been breached has never been found to be compliant at the time of the breach, and that’s probably true.