Yes, they say we have backup procedures, but have they ever tested that the backups work? They write procedures to please auditors:)