The strong ones typically are either better funded or have management in place that is compliance-focused. The weaker ones have limited funds or lack expertise to address all their needs. But typically there’s one common trait shared among all of them, and that is a genuine desire to have everything in place when examiners arrive. If you can provide a credible, well-documented argument why something does or doesn’t make sense to examiners, they’ll consider your position. Or as my father would say succinctly, “It would’ve taken less time to do what you were supposed to than it did to try and avoid it””]
Source: https://www.cuinfosecurity.com/blogs/its-easier-to-comply-than-explain-you-havent-p-63