I don't generally like the "strikes and you're out" analogy, but in cases such as this, I find myself favoring a "one strike and you're out" policy. Or zero st

I don't generally like the "strikes and you're out" analogy, but in cases such as this, I find myself favoring a "one strike and you're out" policy. Or zero strikes, if we could force through effective audits. If nothing else, maybe this would put the fear of [entity] into the organizations in question. The erstwhile incompetent ones. The malicious ones, we just need to give the boot, already.