If a critical vulnerability was found in your systems just before a scheduled audit, what steps would you take to address it?