I'm well aware of those audits and the typical auditor output. Where to start...

These audits check paper. They don't check what is actually going on, they will check that documentation is in place and that processes and various controls are in place and that periodic checks have been performed. They don't actually check any of the underlying tech. For instance: ISO27001 asks for 'regular pentests'. But it doesn't do anything to ensure that those pentests are of a good quality. There are plenty of 'check the box' automated pentest services that get you past that hurdle but that won't do much for your security. They might even give you a false sense of security.

So yes, there are all kinds of audits. But like with everything else the devil is in the details and the quality of the work is very important (obviously!). Many companies treat these certifications like a 'license to operate'. You need to have them so then you do the absolute minimum required to satisfy the auditors rather than to see the certificate as a minimum level of proof required that you have your house in order and that your intent is to deal responsible with your data subjects (and customers) data. The latter is extremely rare.

Yeah, ISO 27001 is paper pushing, but TISAX audits can be pretty painful and detailed (I've been tangentially involved in one, but can't say more). I think insurances are the player to watch the most - they have actual leverage on their customers and really really want to avoid having to pay out for claims, so their demands start to get more and more intrusive, to the point where they can and do collide with stuff like employment laws (e.g. monitor all employee communications through a mandatory proxy service, even if the device is not on-prem).

So do TISAX auditors actually go into systems and check stuff or do they talk to people and look at documents?

Not sure if I can answer that without violating some NDAs, but I think it's safe to say that it's actually worth being called an audit.

Ok, I will do some reading then, thank you and no worries, I understand about the NDA but this being generic information I was hoping you could answer it. But I totally get that you would not take any risk with that.