Security audits don't exist to ensure you have a shit security policy... I think it goes without saying that's untrue. If a particular standard or framework yo

Security audits don't exist to ensure you have a shit security policy... I think it goes without saying that's untrue. If a particular standard or framework you need to meet requires these things there's unfortunately not much your auditor can do. As such, your problem is with the standard or framework you're aligning with not so much the auditor. If a security standard requires you to have a reset policy, then you should have free reign to design that how you see fit in the context of your organisation and its compensating controls.