I read that and it read like a troll, or that the 'auditor' was socially engineering the firm (also possible). It is useful to have passwords explicitly unknown by anyone except their owners and run password cracking software on the password database continuously to weed out 'weak' passwords.