Or you're showing them to technical management, architects, etc, who are quite capable of understanding their importance and see how those lines benefit them, the ones on the front lines for compliance issues.

Your snarkiness aside, that’s why it’s important to find an auditor that understands your business. Traditional auditors understand traditional compliance regimes. If you want to use innovative compliance methodology, like relying on infrastructure as code for instance, then you need an auditor who understands those practices.

Take PCI for example. A couple of years ago they released a document called Cloud Computing Guidelines, which was basically guidance for compliance through software defined network and that sort of stuff. As a PCI QSA (auditor), you may not ever need to know about these guidelines, or that they even exist. But if you want to work with business that rely on them then you’ll need to, and if you want to implement them in your organisation, then you’ll need to find a QSA that understands them.

Auditing is a partnership. Truth be told, as an engineer, you can probably get things past the auditor with some judicious lies and by socially engineering some confidence. I don't even think it would be particularly hard.

But I don't envy you when you get caught. The consequences basically open at losing your job and all possible good references from that job, and get progressively worse from there depending on the kind of audit. I don't intend to become more informed about the consequences, personally.

(I've only waded into this world, but my most likely future trajectory is only up, up, up.)