This focus on internal controls does not necessarily mean that the programs lacked controls but that the existing controls needed to be updated or policies and procedures added to strengthen the overall control system.
Focusing on internal controls doesn't necessarily mean they lacked control, just that they needed to be updated.