This is absolutely key to systems / network administration, I'm increasingly convinced, which are both fundamentally risk management practices (which is why Dev hates both so much).

Failure to drill and audit is professional incompetence at this stage.