This shift in emphasis from approval of individual transactions to evaluations of the adequacy of systems and the internal control environment has been reflected in law and in policy for numerous years.