The remediation point raises another useful distinction: once a firm commits to fix a known weakness, the commitment itself becomes something worth monitoring.

The question is no longer just whether remediation was completed, but whether subsequent evidence shows the underlying exposure actually changed.

The gap between what was promised, what was implemented, and what proved effective can itself become an early warning signal.