Reply to post:

Companies sign up for a consultancy service from one of the usual suspects which results in a shiny certificate they can then wave at the judge after a major incident and say "see, we followed current best practice, so we're off the hook".