Do they have a Security Policy? If not , maybe that is an opportunity for you to implement. You can also develop reports which audit the security .