I worked for quite a lot of companies that had a few planned and random audits by third parties, including government. We did things one way when they were ther

I worked for quite a lot of companies that had a few planned and random audits by third parties, including government. We did things one way when they were there. We did it totally differently when they weren't. Made me doubt the value of anything other than live surveillance of the company or network, remote and with well-paid person stationed there.