Auditing for the purpose of solving a system problem seems reasonable. But auditing for legal reasons makes me feel I am being held hostage by the crooks. We do it because we have to prove we are doing something right. Would anyone ever do that on their own system if no one else was ever using it? Sometimes I years for those good old days when the company was really small and we could just do things to the system and data whenever we needed to to keep things running smoothly. Now we have to prove to the outside world that we aren't the bad guys.