To over simplify things, I understand that what happens hinges on whether we can prove that the snafu was the fault of a lower level employee. That would be "failure to monitor". If we can't, we are looking at the "institutional" thing.
Really pulling for the former.