The True Value of an Information Security Compliance Auditor