We focused primarily on the management framework that these organizations had established rather than on the specific controls that they had chosen , because previous audit work had identified security management as an underlying problem at federal agencies .
The previous audit work was unhelpful in determining whether security management was issue or not in the agencies .