http://cis.org/cadman/how-survive-audit-almost-never-takes-place