[disgruntledphd2]

That's true, but by their nature, external audits are rarer so one would have expected the IA people to have caught this first.