PROVISION FOR AN IT SECURITY AUDIT