Mostly cybersecurity strugles. If you invest millons in a castle with a gigantic lock and a pit full of piranas, would you leave the service entrance open and give everyone in town the key? Yeah, more commom than not.

But an IT audit is only necessary if your company goes public or is the owner wants it, maybe if you are a tech company.