Good question. The issue is probably more subtle: are the intended management controls working and doing their job?