I feel this is extremely important, especially based on your industry. You need to show us, your users that trust you, that this trust is not misplaced. Now, I think it's been long enough that you have not had this done, and it needs to be done.
I feel that most of this stuff you mentioned above has been implemented. You have also previously stated that security is #1.
So then, can we please get a serious answer about this?
Are you doing an audit?
Who is doing it?
When is it starting? When do you expect the results?