There are always two sides to the coin. The auditors are just doing their job, telling you that the software you use is not compliant. What could have been done

There are always two sides to the coin. The auditors are just doing their job, telling you that the software you use is not compliant. What could have been done here is to demonstrate the safety of the algorithm to the organization behind FIPS, so that they can approve it.