break auditing into its own file
reorg