Re: An audit means nothing
"your security policy says you does not say you must encrypt customer data. Do you know if you have encrypted your customer data"
"yes I do know that we have not done that"
"audit question passed the moment you said 'yes i know' ".