At least it's got slightly less bad recently, it used to be 30 days critical, 90 days everything else, now you're required to perform a targeted risk analysis but it's still a lot of work to do.