I expect some folks would see this "rule" as creating a police force without badges who are essentially being granted "no knock" search warrants to seek out innocent as well as intended misbehavior. Worse, the object of the search warrant must pay whether there is misbehavior or not.
Maybe I've become a Libertarian in my dotage, but this smacks of "Kwality Kop" to me. The auditors who do NOT find reportable error will find themselves suspected of being on the take. Worse, there may be some auditors who will engage in extortion to give a clean bill of health to the auditee.
At the same time, I KNOW there are bad apples who violate the letter and spirit of 3rd party registration and they should be discovered and punished. My discomfort is that this police work is done by "private contractors" - in effect,
mercenaries. Many bad things are attributed to mercenaries in various parts of the world. Let us hope the present scandals don't expand to include auditors.