Dear Bruce,
As someone who has spent some time combing through the different responses that ICANN files to the various DIDP requests, my findings are slightly different, and have been posted earlier.
While ICANN does link one to an innumerable array of documents that are publicly available, many times, there is little or no connection between the information one seeks and the publicly available documents that are provided. For instance, I have asked a few questions on registrar/registry audits, specifically seeking individual contracted party audit reports in cases where there have been breaches or discrepancies. However, the response contains a large number of links explaining ICANN's three-year-audit process in great detail, and at the end has a rejection of my actual request on the basis of certain of their extremely vast and broad grounds for non-disclosure. I like to refer to this as ICANN's tendency towards
documentary obfuscation where they aren't actually giving you the information that you need, but are drowning you in documents anyway.
That 66 is a figure that we might need to scrutinise closer in terms of how effective those disclosures actually have been.