financial audits are compulsory, so why aren't security audits? Taking

things one step further, should penetration testing should be mandatory?

Historically, compulsory financial audit does not happen for the

protection of businesses, shareholders, staff or customers; it exists

primarily to prevent evasion of taxes. Governments, who are not well