Code auditors are a crapshoot. I worked around financial auditors and they were much more consistent but thats likely because standards are more well defined.
If you get a good auditor they can find a ton, but most are box checkers there to make the audit company as much money as possible.
If you get a good auditor they can find a ton, but most are box checkers there to make the audit company as much money as possible.