The point of these types of audits isn't so much to determine "security" its to leave a paper trail so that people aren't accidentally lying to customers. It proves that you are either doing what you claim to be doing or intentionally being decitful. It cuts out the murkey middle ground, of "we didnt do what we claimed, but its all a misunderstanding & accidental so you can't blame us".
How much it suceedes is debatable but auditers being security experts is irrelavent to those goals.