Comment by disgruntledphd2

That's true, but by their nature, external audits are rarer so one would have expected the IA people to have caught this first.