I would agree that their policies, and governance controls are inadequate....and still have adequate testing.

Obviously, something was very very inadequate.