On your first point, I think that's pretty common in M&A. For example, let's say the audit revealed that the target did not enforce minimum password lengths for

On your first point, I think that's pretty common in M&A. For example, let's say the audit revealed that the target did not enforce minimum password lengths for employee accounts. Amazon could simply say that needs to be re-mediated before Amazon is willing to close -- so the target can just implement that change, and certify it was done and/or have the audit firm confirm it.