This doesn't mean just appearing to be compliant (which is why the operation has been around so long).
I don't think anyone has their head stuck in the sand Dash. If they have given the appearance of being compliant it means they have been pulling the wool over the regulators eyes. How do you get away with that? Superficial auditing? Audit personnel not up to the task for whatever reason, perhaps untrained? Once again it highlights deficiencies on the part of the regulator. Is that because there are not enough auditors on the ground? The ones that are there, do they have the resources (budget/time etc) to do an adequate job? I'm afraid I'm not in a position to provide answers to those questions.