 and expose the 
repository to increased risk. Alternatively in the process of collecting evidence the repository 
system may be damaged. 
While these are all valid security concerns, they fall outside the purview of this 
Recommended Practice, which applies only to the metrics which an auditor should use for 
auditing a repository. 
A3 POTENTIAL THREATS AND ATTACK SCENARIOS 
Impersonation of an auditor and/or release of confidential information could both result in 
exposing the repository and its holdings