If audits and revisions are not planned in a long-term, centralised manner, individual areas may be audited very frequently, and others not at all. As a consequence, it may be very difficult or impossible to assess the security status of the information domain at hand.