diff --git a/rules/audit/audit_control_mode_configure.yaml b/rules/audit/audit_control_mode_configure.yaml
index 515fe6e7..c181c364 100644
--- a/rules/audit/audit_control_mode_configure.yaml
+++ b/rules/audit/audit_control_mode_configure.yaml
@@ -3,7 +3,7 @@ title: "Configure Audit_Control Owner to Mode 440 or Less Permissive"
 discussion: |
   /etc/security/audit_control _MUST_ be configured so that it is readable only by the root user and group wheel.
 check: |
-  /bin/ls -l /etc/security/audit_control | awk '!/-r--r-----|current|total/{print $1}' | /usr/bin/wc -l | /usr/bin/xargs
+  /bin/ls -l /etc/security/audit_control | /usr/bin/awk '!/-r--[r-]-----|current|total/{print $1}' | /usr/bin/wc -l | /usr/bin/xargs
 result:
   integer: 0
 fix: |