What security element must an organization have in place before it can implement a security audit and validate the audit results?