Thanks much nihil! Will do.

Also - part of what I was going to include in my checklist (and I will also run this by catch and cacosapo) the following from SANS:

When conducting an IT audit don't rely solely on automated tools, rather employ the following strategy:

1. Automated scanning tools
2. Time at the console with the administrator(s)
3. Interviews
Now SANS states that with 2 and 3 above, you would get more information than just using the scanning tools alone. So far in my experience, I would say that is possible, but it depends on 1) interviews: your interview style and the willingness/comfort level of the interviewee 2) console: know what you are looking for.

Anywho - thanks again.