I'll go to obligations and accountability. It's the responsibility of the organization that has the delegation or authorization to do a correct assessment and then notify the regulator when it's of a certain risk. It seems that they did not make an appropriate assessment, so it wasn't flagged to the regulator.