I guess you do know what is meant ny "outside the normal use of an application". I would get confised on such a generic recommendation from a highly paid auditor.
Actually you don't want to audit everything, just audit the things you need. That way you can minimize the auditing you do.
Raj ---------------------------------------------- Got RAC? -- //www.freelists.org/webpage/oracle-l