...sensitive citizen data. Controls, risk assessments and selective audits are not sufficient. That combination failed the financialsector. It didn't curb the excesses of management, nor did it highlight the growing indications of impending disaster...
http://www.computerweekly.com/blogs/david_lacey/2009/02/back_to_basics.html