Our issuing system is antiquated. The kinds of controls the Auditor General was looking for don't exist in the system. We had to put in a number of manual controls, which were a band-aid. That was admitted to the Auditor General and her team when they came.
In the interim, our IT team has been designing automated controls for monthly reviews and deleting old access accounts to ensure that people don't have multiple accounts. It's all done automatically now, or it will be shortly. I believe that's being introduced in the fall.
It has been a process of getting it done. It wasn't quite as simple a task as we thought it would be because of the age of the issuing system.