You don't need to get an Audit for Compliance with GDPR.

Whoever told you that was scamming you