If IS audits are not planned in a centralised, long-term manner, individual units within an organisation may be audited very frequently, and others not at all. It is also possible that changes to the ISMS will not be sufficiently investigated if audits are only carried out sporadically. In such cases, it is very difficult or even impossible to assess the security status of the information domain at hand.