That was my next question, about satisfactory/unsatisfactory, but you've already articulated that, Mr. Auditor General. I appreciate it.
But let me just quickly read into the record the very bottom of paragraph 2.29:
Unlike the previous version of the Policy, the 2009 Policy does not state whether contracted firms with access to protected and classified information are required to hold a security clearance. In our opinion,
—this is the Auditor General's opinion—
this is an important gap that could result in inconsistent application of the Policy and thus introduce additional security risk.
So not only did they not follow through in 2007, but we get to this point in this audit, and lo and behold, we still have the Auditor General saying there's security risk, in paragraph 2.29.
Sir, I'm looking at page 68. There's a chart, exhibit 2.8, and I'll go specifically to National Defence. It shows the “Number of contracts with security requirements” and the “Number of contracts without security requirements”. The total is 48 for the two of them: 25 with and 23 without.
According to your final column, “Number of contracts with incomplete or absent security documentation or improper application of controls”, it's 32 out of 48 for the defence department. This is not the transport department, VIA Rail, or the postal service—no offence to either one of those two crown corporations; they're both brilliant crown corporations, I think—but the defence department. That translates into 66% of these contracts that didn't meet the requirements when it comes to security.
Are my numbers off there, or am I correct?