HIBT security audit methodology