title: What should and shouldnt be audited in a Java EE Project
body: <p>I am in a need for advice in the matters of auditing a project.  </p>
  
  <p>Currently the project I am developing has many actions a "user" can perform such as:  </p>
  
  <ul>
  <li>Changing his own password</li>
  <li>Adding, removing permissions</li>
  <li>Adding, removing roles</li>
  <li>Upload files</li>
  <li>Many others..</li>
  </ul>
  
  <p>All these actions which are reachable to a User, are audited, however I don't know if its usual to for example audit the following:</p>
  
  <p>Password policies state that the User password must include at least 1 symbol and 1 digit. Certain user at certain time tries to change his password without caring about the policies, of course he will get a message stating password policies are not respected, but should this be audited? I just want opinions from people that have audited before, or know on the matter.  </p>
  
  <p>Another possible case can be, when a user, tries to delete something that doesn't exist, for instance, having an empty list of permissions and trying to delete a non existing one, once again the user will get a message saying to select at least one permission to delete, but should this action be audited?</p>
  
  <p>Any feedback is welcomed, my first time auditing a project, thanks :)</p>