Perspective is important. Historically, merchants, PCI service providers, and banks have had to rely on their
QSA of record to provide architectural advice for the very same ecosystem that they have had these individuals
audit.

Card Systems, Hannaford, TJX, Heartland. Hackers do not pay mind to the controls you -think- you have. They are only prevented from accessing your data by the ones that are functioning.

External audit is difficult. Having your assets seemingly arbitrarily examined and scrambling to deal with every audit situation is often a painstaking process.