Compliance audits must go beyond only the technology