In keeping with their role as advisors and facilitators, most of the security managers said that they relied significantly on auditors to test controls.
One could say these security managers are failing to show initiative.