The article highlights the problem pretty well.

A lot of companies can't set up a proper audit trail or system inventory, how can we trust them with managing other people's sensitive information and infrastructure if they can't even handle their own properly?