[lucianbr]

CYA is the reason you do the audit. But the reason for the audit's existence and requirement is definitely so that hacks don't happen. Don't tell me regulatory agencies require things so that companies can hide behind them.

[bonoboTP]

The reason for the audit's existence is CYA one level above. The chain ends with a politician's CYA in front of the electorate.