An auditor told me that happens more often than it not happening. Personally if I had to do that, I'd leave the company but this guy gave no indication he was going to raise nothing.
Sounds awful but if a technical person had a word with me about raising something so it got fixed, that would have me digging more on their culture plans and looking for lack of engagement from senior leaders on it. Much like people arguing the toss about things being a non con or not does when it's really not a grey area issue. I don't audit GFSI but I'm surprised more auditors don't take that approach. If someone is just looking for audit compliance and is having to ask you to get things raised for funding, what other signs do you need that their culture is at a very immature stage? Fair enough if that's reflected in their culture improvement plan but most sites like that barely have a plan or claim they're far more mature than they are and play lip service to improvement.
