The five-year bug escaped detection because auditors verified that the intended random number generator existed, but not that it was being called.
eBook | Regulatory Guide to Money Transmission and Payment Laws in the U.S. (3rd Edition)