Yes. It's like finding a security vulnerability without any evidence it was exploited. Just because an AP clerk could embezzle money that way, doesn't mean tha

Yes. It's like finding a security vulnerability without any evidence it was exploited. Just because an AP clerk could embezzle money that way, doesn't mean that they've identified evidence of that happening. But now they've reported that lapse in financial controls (which may or may not have been addressed), and warned that there may be others.