Is your company's information that interesting? We had to prepare for an audit, and concluded that our info is simply not worth the effort. People get training

Is your company's information that interesting? We had to prepare for an audit, and concluded that our info is simply not worth the effort. People get training in noticing phishing emails, but the only one we've ever had was a cheap shot at getting someone to transfer money. We may have been wrong though, and overlooked something.