They are not all-inclusive and may not include particular control activities that an agency may need.
Agencies might need controls that aren't included.