A client added a data security section to a new working agreement, and while everything else (documentation, established procedures, etc) is fine, the annual audit might be a problem: we simply don't ...