Please do not feel content to rely on the audit. The GHAs that I and some of me colleagues deal with perform this critical functions often below par. GHA staff are continually hired and fired and obtaining levels of competance and conformance is very difficult. The USA in my experience is one of the first to fail audits and to have staff that have little or no training, one has only to observe their security staff performance levels and expertise.