in my experience with in enterprise businesses the DevOps people are almost the worst people to handle Governance, not too great at end to end Security (I've no idea about Audit)

IMHO I would guess they're too close to the dev people to care about the bigger picture