As a result, the effectiveness of individual system administrators in maintaining security controls and spotting incidents is likely to vary.
The individual system administrators were effective in maintaining security controls. 
The security controls were too lax.