Your auditor needs to tell you how they think that those folks are going to be able to change a DD object. My response would be that the only way that I know of to change that is using those transactions and that they are fully controlled. They don't just get to make up stuff as they go along. They have to have evidence to prove their assertions.
Neal