Again, without having actually gone in and audited what they're doing, I think you've probably characterized it fairly well. It sounds as though they are being proactive, that they've made a step in the right direction. Maybe something a little more formal would be the best practice.
On November 29th, 2012. See this statement in context.