If you have the trust, it helps (ime) to drop hints that the auditors are not very knowledgeable / are giving false alarms / are taking the easy way instead of

If you have the trust, it helps (ime) to drop hints that the auditors are not very knowledgeable / are giving false alarms / are taking the easy way instead of really checking the systems. Such automated tools are meant to be operated by someone who understands the technology. That said, there is probably some API you use, they should be checking that instead.