I may be nitpicking here, but it seems to me that an audit is where you collect information and examine data, but you don't change anything. An audit may make r

I may be nitpicking here, but it seems to me that an audit is where you collect information and examine data, but you don't change anything. An audit may make recommendations for followup, like "reset everyone's password" but I wouldn't say that that action was part of the audit proper. It almost seems like they want to blame audits for messing up the status quo here. Audits are good. Audits uncover bad things and help orgs move towards compliance. Love the audit.