The two are not orthogonal. I used to do some work in financial services and some of the systems were designed not to run risks in case of misconfiguration.