Can I internally audit as a one-time event? Is that robust?