e. 
There is a possibility that the person contacted is not in fact the person that the repository 
believes him or her to be.  Alternatively the correct person may be contacted but in fact 
another, possibly malicious, person may turn up to perform the audit. 
In the process of collecting evidence for the various metrics the auditor may collect 
information which is confidential or sensitive, for example details of security weaknesses.  
There is a danger that such information may fall into the wrong hands