This whole charade feels exactly like ISO-9000 and SOX compliance. Both were a pretty simple idea: document your policies, and document your adherence to the po

This whole charade feels exactly like ISO-9000 and SOX compliance. Both were a pretty simple idea: document your policies, and document your adherence to the policies. In practice however, mid-level managers at Fortune 500's sprang into action to implement every idea thrown at them by white papers, underwritten by auditing firms, who would then be hired to come in and judge whether the company was adhering to their recommendations for compliance, which ultimately had very little to do with either precision and accuracy (in the case of ISO) or separation of roles and security (in the case of SOX).