Right, that's exactly why the audit company isn't signing off on code audit or pen testing. They can only sign off on a simple checklist, if a caveat is listed

Right, that's exactly why the audit company isn't signing off on code audit or pen testing. They can only sign off on a simple checklist, if a caveat is listed in the financial reporting. They have no proficiency or enough people who know what they're doing. The approach is to meet the lowest common denominator set by the SEC or is expected from investors.