What we point out in the report is that the department responded to the recommendations that had been made in that internal audit, and because there were no recommendations around conflict of interest, the policies at that time did not mention it.
On October 28th, 2009. See this statement in context.