That's where they need better-educated, or more capable auditors. I used to do PCI auditing for organizations that handled credit card data. The course was a t

That's where they need better-educated, or more capable auditors. I used to do PCI auditing for organizations that handled credit card data. The course was a two-day joke, and they relied at the time on some stated level of prior experience. Clearly, the class was intended to give you knowledge of what's required, and how some processes worked, but you were expected to know the security stuff first. While I was not a huge fan of the organization, I was somewhat more satisfied when I could help the clients with reasonable analysis of their controls, and where they'd fall down (regardless of tick-box compliance.)