A Risk Management Perspective on RAC Audits