A data stewardship approach to security audits