This is true. They (the auditors) usually have guidance or areas they need to see policy address, but not specific implementation details.

Using common, overbearing MDM or endpoint tools make providing evidence of adherence to policies easier, however.