It's even worse than that from experience. Most of these financial institutions had terrible practices before and the surface area of their terrible practices i

It's even worse than that from experience. Most of these financial institutions had terrible practices before and the surface area of their terrible practices is huge and mostly unknown. So when they go and apply some new super secure process or audit they don't actually apply it across their entire estate or the organisation is so thoroughly compartmentalised that it's impossible to get everyone to align with the goals of the audit. The only outcome is what they call a partial success but I call a complete failure.