An auditor comes in and once issues are found, the company then writes policies around it so that never happens again (in theory). This reminds me of shutting the chicken coop door after the coyote has ate all the chickens. Wouldn't it be better to be proactive? How could you identify issues before the auditor arrives?