> and companies that address IT liability by getting a bunch of forms filled out that don't have anything to do with information security won't be secure.

So glad to not be at that job anymore , this is 100% the approach my previous employer took ( who had 99 out of the fortune 100 companies as customers ).