Does my IT company need a compliance audit?