What do security auditors really think?

What do auditors involved in making sure companies meet compliance requirements really think? For starters, companies don't care much about privacy and security, while encryption gets applied at a minimum to meet rules, according to a study of 505 security auditors by Ponemon Institute.