During an IS audit based on IT-Grundschutz, the IS auditors collect confidential information (such as on vulnerabilities and attack options). They may also identify shortcomings in the information security of the audited organisation. If these shortcomings become known to unauthorised third parties, they could be used to attack the organisation or bring its name into disrepute.