&gt; <i>As a matter of fact, our system had to face penetration tests conducted by Ernst and Young, a big 4 Auditing Firm</i><p>Auditing is not about security. It&#x27;s about checking if proper procedures are in place, separation of duties, there&#x27;s &quot;access control&quot;, etc.<p>One thing it&#x27;ll miss out on is the security of the system. You say that they performed penetration tests, but IMO saying that E&amp;Y performed it makes me doubt the security.<p>FWIW, company I work for also has the big auditing firms (all of them) come along and perform audits.