Employees may fear that their own errors will be discovered during an IS audit. To avoid this, they could conceal security problems and thus give a false impression of the actual level of security at their organisation. This allows security deficiencies to remain undiscovered and uncorrected. It also prevents the organisation's top management from assessing the risk associated with such deficiencies.