We did not look at other organizations in the context of this audit.
As you said, we focused mainly on these two organizations. As you specified, we did not see a comprehensive strategy put in place by either organization that would help them identify the risk, prioritize the objectives and measure results.
Unfortunately, we did not do any specific comparison with other organizations as part of this audit.