audit: make validity checking generic