Our finding really is flagging the risk that it could occur. When you don't have the right security clearances on file and you haven't checked that, there is a risk that personal information, government information or government assets could be exposed when they shouldn't be.
We did, however, look at some of the contracts. We didn't look at all of them in detail and we didn't find any breaches. Not having the information on file doesn't mean the person didn't have a security clearance; it means it wasn't there.
We also looked at this in ArriveCAN and didn't find breaches, but this is a risk. If you determined that a contractor should have security clearance, they should not be doing the work until they have that security clearance.