During a security audit, it has been promoted that it is important to include all end users, which would involve all staff and also your customer or client base. There are risks for both of those groups that are not included in the IT or Audit department. Who do you exclude from the security audit?

Provide at least two supporting arguments for excluding this group.