Making the Audit: Pinpointing the right IT compliance strategy