Every management system standard, whether it covers quality, safety, environmental impact, or information security, relies on the same basic mechanism to stay honest: auditing.