An audit means nothing if you have the ability to send and execute custom code to any device which uses your hardware. No one is going to audit an internet conn

An audit means nothing if you have the ability to send and execute custom code to any device which uses your hardware. No one is going to audit an internet connected Windows 98 machine and say "Yup, no malware on here", and expect that to hold true for even a second after the statement was made.