If you are a team lead doing programming for one of these sorts of companies and the auditors come round with some findings, I promise you that you need to take it deadly seriously. I've seen engineers fired for cause by the board of directors of a fortune 500 for failing to do so. Word gets around and nobody will touch them after that. Its literally career ending to poo poo audits.
Tech companies are really the odd man out here when it comes to audits. Who knows how much longer that will last.
It means delaying or coming up with excuses for why you can't have security concerns remediated within the agreed upon time frame. Regardless of the technical challenges involved.
Audit remediations are not the kind of projects where delays are acceptable. You absolutely must drop everything else you've got going on in those situations if you even remotely get a hint that the project might be behind.
The reason here is that your boss and your bosses' boss can't save you. If bad audit results come back you can bet the C suite had an emergency meeting discussing how to explain them to the board and the timeframe for getting them fixed. And you can bet they made some sort of commitment.
There are hundreds of millions to billions of dollars on the line in insurance premiums and future legal process in some cases. Oftentimes cyber insurance will mandate some kind of timeframe for remediation upon notification of a security issue. So you'll get hit with penalties well before the next audit if you delay. You don't want to be the programmer(s) that missed a deadline there.
You audit accounts that are falsified and give thumbs up: you close shop, are held liable for damages and could go to prison.
Auditing companies are crucially important for a working economy. Bank loans, bonds, equity markets would all be chaos and fraud mayhem without them.
We might as well turn "audits" over to the short sellers like Hindenburg Research, at least they make money by exposing rotten accounts rather than hiding them.
The fact that being an activist short seller has become a business model in the last ~8 years tell you how bad the likes of EY are.
RATING agencies are different from AUDITING companies different from CONSULTANCIES.
Rating agencies were somewhat restructured after 2008 (but are still kind of edgy) - because they did literally write AAA on a piece of paper for money. But there ratings were opinions and had no real legal meaning.
Enron’s problem was the “consulting AND auditing” mess with conflict of interest if I am not mistaken.