When the system has been defined well enough to manage risks effectively, the agency develops and tests a full-scale system.
The system can manage risk effectively if defined well enough.
The system is unable to manage risk effectively at all.