Mechanisms exist to ensure that vulnerabilities are properly identified, tracked and remediated.
Does the organization ensure that vulnerabilities are properly identified, tracked and remediated?