One in five users can expect an audit in the next three years