seems pretty obvious to me that the auditors we got really have no understanding of what they are asking for.  most of things they ask for or find are being read from a list of common best practices in the industry