That's a feature of the absurdity of compliance checkboxes.

If the auditor is an idiot, you can get a moderate finding for doing things like applying a security patch that isn't FIPS validated, or similar nonsense.