This feels like another case where there should be legislation, but would never get done. It would also require admitting that auditing requirements are so burdensome that they are used to arbitrarily enforce policies, which no one wants to do.