Having a qualified and independent board is important but not enough.
A qualified board is crucial, but not crucial enough.
The organizations could readily identify previously unkown vulnerabilities and either eliminate them or make adjustments, all by allowing such tests.