Information security auditor