... someone other than the person who drew up the proposal/bid to review it. I know that's a requirement in design review but didn't really consider it for bids.
Being a customer requirement we started having a different person review and it's turned out value add for us, second set of eyes and all that.
Nope., it isn't a requirement in design either. If you read through the relevant clause, you won't find any requirement for someone 'other than' the designer/s to review. It may well be good practice in many cases and often is. As Michelle says, incredibly important in software design. But in other cases, it isn't - in some it would be overkill. Remember, it is not a specific requirement.
Now, it's good that in your case the change turned out 'value add' but also its important
not to let what an auditor 'wants' to drive your system. It's about
what the requirements are,
not what any auditor wants. Your system, not theirs. Sure, they are there to test the system, and it's reasonable to discuss why you don't have independent reviews done ( if you don't ) and be able to point to evidence of why it isn't problematic ( including absence of evidence such as problems graced back to inadequate reviewing).
It's up to you, as an organisation to decide what works
for you.
I'm with Randy on the vat of sour cream option.
