I’m curious whether the government certification / reporting process is punitive in nature and perhaps provides incentives to fabricate compliance. I’ve led a f

I’m curious whether the government certification / reporting process is punitive in nature and perhaps provides incentives to fabricate compliance. I’ve led a fintech startup through IT security audits mandated by top US banks and found them to be highly collaborative and helpful. Much less of a “pass/fail” judgement and more “you’ve made it to X on your own; here’s some resources on how to hit Y affordably so we can begin to do business.”