however, both ig evaluations and our own ongoing review have identified deficiencies in the c & a processes such as lack of control testing and outdated risk assessments.
as additional systems are certified and accredited and controls tested, it is likely that additional deficiencies would be identified.