It's actually not that unusual a request... they may simply need to justify *any* access to production, and that includes you. They need to be able to tell an auditor why you have the access that you have. I've been through the same process myself.

The best response to do is create a list of the things you do in production that require access. Be as complete as possible, and try to provide it in such a way that a non-technical person (which many auditors may be) will be able to understand.