Excellent article Brian, and one which applied equally to sysadmins and security managers. Highlights too the failings of auditors, who all too often seem to only be after ticks in boxes to obtain paper compliance, rather than really testing that the procedures that are in place actually work. Should be required reading for anyone who runs a business that relies on IT.