Certainly you're right that there could be additional controls in place, but we were able to identify, for example, that those locally engaged staff were looking up their own information. The ability did exist. The control in place was that they were not supposed to do it. They should have gone further and they should have done the analysis themselves of the information they already had. They could then perhaps even take an additional step, which would be to try to build in electronic controls in the system. That would be another way. There are different levels of controls, and they didn't have all of them, but they should have been able to identify that these types of situations were happening. As Mr. Swales said, they already knew in the past that these situations had happened so they should have drawn on that to look at their database to identify when those types of situations might be happening.
On May 17th, 2017. See this statement in context.