Undeveloped financial and security processes aren't a question of solely integrity.

You need integrity to implement them, but just having integrity doesn't mean you're going to implement them, or to implement them correctly.

You need expertise, experience, and to get burned a couple dozen times before your institution figures out how to do these things right. And even then, it's a constantly moving target.