Same for the PCI compliance process. Auditors are on your side and want you to pass, so they'll bend in all sorts of ways to accept bad practice as "acceptable at this company"