This is pretty much where I was coming from too, although better articulated. I do see value in the structure of responses, but if we have already done everything we need to then we should be able to respond to the audit formulaicly.

Though seeing the other comments that Vanta + audit being cheaper than audit alone is an interesting quality and may change the initial defensive rejection I have for receiving cold contact mail on non-public addresses (which means they also buy harvested data).