Couldn't you have satisfied the auditor's need for compliance as well as your own sense of security by simply composing SHA2 with bcrypt? Hash(password) = SHA2

Couldn't you have satisfied the auditor's need for compliance as well as your own sense of security by simply composing SHA2 with bcrypt? Hash(password) = SHA2(bcrypt(SHA2(password))) A SHA-2 based hash with similar performance as bcrypt...