They gave a report that said it's plagued with serious problems and the framework needs to be reviewed. I'm not talking about ongoing reviews that every organization does.
Was a specific review done to comply with that recommendation? That's what I'm trying to find out.