you have to look at the audit record too