Again, without having actually gone in and audited what they're doing, I think you've probably characterized it fairly well. It sounds as though they are being proactive, that they've made a step in the right direction. Maybe something a little more formal would be the best practice.
