Audits don't involve fine-tooth-comb review of everything - PwC does not go through your git commits line-by-line. They tend to verify specific critical things

Audits don't involve fine-tooth-comb review of everything - PwC does not go through your git commits line-by-line. They tend to verify specific critical things and verify process for everything else. To the extent your processes don't match what is reported, your audit is a work of fiction. And of course things will always fall through any available cracks, people skip process for various reasons, etc.