What are the challenges to formalizing and marketing an IT operational audit?

I've developed a structured audit to determine the effectiveness of an organizations monitoring, incident and problem management functions in preventing and reducing IT related customer problems. A good example of ineffective monitoring would be Target, where supposedly the monitoring team received a hacking alert and sent a notification to the security team but never followed up on it.