I think I'll answer that in two parts.
The first thing that could go wrong—and did, in a sense—is not alerting the senior levels of the organization and the government to a growing risk around, say, deferred maintenance.
We accept the premise of the Auditor General's report that this vertical alignment of risk management has to work so that it goes all the way through to the minister.