What of the claims that information control is extremely loose internally - i.e., an employee can easily gain access to users' private data without sufficient g

What of the claims that information control is extremely loose internally - i.e., an employee can easily gain access to users' private data without sufficient gating, and that accesses such as these are not easily auditable?