Premise: The organizations we studied had recognized that monitoring control effectiveness and compliance with policies is a key step in the cycle of managing information security.

Hypothesis: The groups we studies were unaware of their need to monitor control effectiveness.
Relation: contradiction