...sideways at what everyone else is doing. Compliance is not an overnight activity. It requires a gap analysis, impactassessment, business case and a rectification programme. You can’t conjure new budgets and the necessary resources out...
http://www.computerweekly.com/blogs/david_lacey/governance-issues/