better handling of audit event