It’s a trap. You reply with the policies that prohibit what he’s asking. If you don’t have any, that’s a finding. If you do and violate the policy, that’s a finding.

When the premise is that the auditors are idiots, you have a problem. ;)