"Such policies indicate either an agency that is not concerned with preserving good audit chains or one that has an extremely penny-wise, pound-foolish approach to IT policy."

I think AND is more appropriate than OR here.