audits

Having everything packaged separately means you can do audits much easier and without location-specific checks.

It is not allowed to pay less than market price and the government audits it.

For small companies, accounting rules are fairly relaxed (no audits required, just basic accountant review).

Does the EV certification process put any requirements on the CA, such as mandatory independent audits or some other overwatch mechanism?

I'd say encourage such companies to keep a team around for paid audits and extensions of their product.

This is no different than how finance companies or health companies go through audits and such with both process and data handling.

And if they actually have their acts together, wouldn't those same insurance companies start insisting on basic audits of their client's systems?

Yes, a big problem with table-level audits is that you lose all kinds of information about the other entities in the system.

In Madoff's case, he passed SEC audits, licensing requirements, etc with flying colours.

Depending on the level of management and the systems involved it could also become involved in audits, regulatory matters and potentially handling confidential information for the company.

Use that as a gateway to selling security audits/monitoring.

As we grow, we'll definitely be conducting regular audits of our infrastructure.

Cousin?) and a list of many skills, including "Information Security", "Security Audits", "Vulnerability Management", "Ethical Hacking" and less funny ones.