Auditors don't need write access to the system. And audits absolutely do include a careful accounting of who has access and what is being accessed.