If an auditor or revisor is insufficiently qualified or prepared, they might incorrectly assess the security status of an organisation. The resulting audit report could thus fail to include necessary corrective actions or even recommend improper safeguards. In the worst case, this could lead to excessive (and thus non-economical) protection of information, or insufficient protection that entails a great many risks.