Audits can be done 'read only'. Audits don't actually have to impact the behaviour and operation of an organization either. Stopping all activity because of an 'audit' is ... wrong.