Organizations that do not have a compliance program when one is indicated are in the wrong, but organizations that identify the need for a compliance program, lay out the program and then fail to maintain it or cannot prove that they are carrying it out are demonstrating negligence against their own self-identified requirements. This can lead their customers, auditors, and regulators to speculate what