@calamari One thing I would add to this, which I have witnessed too often first hand, is the incompetence in evaluating those risks. When the consultants say that this should be done, there is no further probing into whether or not this actually mitigates or even introduces risks.