premise: The groups focused their efforts on increasing everyone's understanding of the risks associated with the organization's information and the related policies and controls in place to mitigate those risks.
hypothesis: It was decided that the groups could make no impact on awareness of risks, so, instead, they focused on mitigating risks directly.