But wouldn't "open standards" help in that situation? You could tell the auditors: "Sure we're a small company, but if we fail it won't put your business at risk because you'd be be able to swap it out with anything else complying to XYZ standard."
LOL! No, of course not! You can comply with whatever standards you like for data coming in and data going out but it's what you do with it in the middle that's what an application does.
