Companies should not wait for regulators to fix gaps, they would do well to proactively establish a strict internal control framework