If IS auditors are not sufficiently qualified or do not sufficiently prepare for audits, they may misjudge the security status of an organisation during an IS audit. In some circumstances, they may then fail to recommend the necessary corrective measures—or even recommend incorrect measures—in their audit report. This can lead to information being protected in an uneconomical or high-risk manner.