One of the truisms of the compliance biz is that it is very difficult to argue your way out of a finding if that finding is the result of your organization failing to comply with its own policy/practice.