The question is not whether this is happening in your organization. The question is whether you find out before or after a regulator does.