To put it (my point) another way, if a company has a choice between spending an hour on work that relates to its actual business or spending that hour auditing its own software compliance, in almost all cases -- especially when the economy is bad -- the choice is going to be the former i.e. to make money.