Auditing Architectures - Implementing Database Security and Auditing - page 389

Figure 13.7

The reality of
changing audit
requirements.

6. Auditors will then usually do some homework and come back

with a very long list of audit requirements, which are often
impractical (or ineffective), and DBAs are not shy in commenting
on this fact.

7. Unfortunately, the next few months (and sometimes even years)

can be spent in setting requirements, implementing them, revis-
ing the requirements, reimplementing them, more requirement
changes, and so on.