This is something we've discussed many times in the lab. We run across companies every day that we know to be compromised, yet their annual reports show nothing.
I'm not going to spend a lot of time in this, as this Bloomberg piece says it all...
http://www.bna.com/unthinkable-may-need-n17179891721/
