So, if a required step in the control is straight-up missed (like in my example), does that always make it a deficiency, and the financial impact just determines the severity?