Yet again some oversight body / de facto regulator gave wind that they already had changed to auditing Culture and the Tone At The Top including Behaviour and Awareness, apart from mere ([ed.]) process and technology.
To get the latter off the table: Good. ‘Technology’ wasn’t understood the least bit anyway; really (sic).
And Process, ah finally they found that about all they had done in the past, was windbaggery of the worst kind. Yes, process has its place, but a so much more minor, subaltern one than the past Tragedy (sic, again) that ‘governance’/GRC/compliance/SOx was …! Yes again, it really was the little chicken pretending to be a full-grown eagle.
So now, they ‘have’ turned to Culture and related blah. About which they have no clue or would had to have fired a majority of own staff and hire complete+ replacement with psychologically skilled (i.e., fully a square angle to -educated) staff. Which they haven’t, or would have found out that the new skill set would have burned down the house that was.
Of which no (smoke) sign is in sight.
So, … words; the Tom Tom Club was right.