Major problem of entire compliance/auditing industry is not enough asking in companies "what are the actual risks we are dealing with", "what's the goal for given control", "do we have alternative control ensuring that".

Compounded by cheap shitty auditors that just mark down checkboxes on a worksheet