At least it suggests that the current standards and auditing practices are not sufficient, and apparently formulating testable requirements is difficult.