The last thing I want to do is push an auditor into doing a deeper audit, but they don't seem to understand tiered architecture.  I would agree with you that they're working with a checklist, and don't know when they should look deeper.