In a well-functioning system, the auditors ensure the agreed security policy is implemented; they shouldn't have any power over what the policy says. As such,

In a well-functioning system, the auditors ensure the agreed security policy is implemented; they shouldn't have any power over what the policy says. As such, the author cannot (should not be able to!) change the policy by appealing to the auditors. Explaining why you are non-compliant to the auditors is a wasted effort: you are talking to the wrong people.