We focused primarily on the management framework that these organizations had established rather than on the specific controls that they had chosen , because previous audit work had identified security management as an underlying problem at federal agencies .
The framework of management was our biggest focus .