This is simply not carried out by auditors; it is completed by the databrackets crew to find out the gaps within the process. This provides them pretty distinct tips of controls they need to layout and implement. E-commerce retailers who outsource all payment processing to PCI DSS validated third parties, https://www.nathanlabsadvisory.com/blog/nathan/ensure-the-security-of-your-source-code-analysis-in-the-uae/