I wouldn't be surprised if these auditors were like this or even worse: http://serverfault.com/questions/293217/our-security-auditor...