I would have liked it if the audit had also provided a number of logins to be used on that server to act like typical users. Just so it was operating as a normal server would.

This could have led onto auditing a live server.

Auditing an in use customer facing server would definitely require a good amount of controls to ensure the auditors didn’t log any possible customer data.