They are not checking if your systems are, say, vulnerable to a SQL injection attack. Take a look at

http://www.webtrust.org/homepage-documents/item54279.pdf

and say, a typical CPS

https://www.digicert.com/wp-content/uploads/2017/01/DigiCert...

They do an audit to check if all practices and procedures follow these guidelines.

Ah, a checklist audit.