said by B 
:Your auditors are misinformed and/or misguided. There are no safeguards that can be put in place if you don't trust the IT staff who are responsible for putting in the safeguards!
If the auditors wish to ensure that only mailbox owners can see their e-mail, then it should be a company-wide enforced policy that ONLY encrypted messages are sent, received, accepted, and viewed.
If you've got a mail store full of
unencrypted messages it's an exercise in
major stupidity to try to police your IT department. Who cares if they haven't accessed a message yet -- they can at any time! What if a backup is taken off site, or a disk or VM image cloned? Who watches the watchers?
Auditors are idiots. Try hard to avoid them.
-- B
I am sadly aware that auditors are indeed the spawn of Satan but it does not preclude me from having to answer to them. I'm not so sure that they are looking to revoke authority per se but rather for the ability to see if authority inherent to being an admin is being abused.
