It is true in a very general kind of way, but we no longer live in a world when one admin controls every aspect of company's IT ( with maybe exception of small mom and pop shops ). As a result, default controls in place have gotten a little more granular ( and annoying ). All that said, the evidence by itself is not as useful as the hired expert, who explains what the evidence is, how we know it is good and so on.