AUDITING FOR SECURITY AND INFORMATION MANAGEMENT