Recently I again accompanied the audit for a client and brought it to a successful close. I would like to take this opportunity to stress how important the right approach to the QSA is. In some (maybe many?) companies the QSA is seen as the enemy, he is the "evil auditor". That is not true, and it is also a mistake. The certified or soon-to-be-certified company is the customer and the QSA company is the service provider. PCI audits are not official inspections by a data protection supervisory authority or the like. You pay for the audit, so you should make the best of the situation.
Once you drop the notion that the audit is the "bad guy" and remind yourself that you are paying for a service, your approach changes automatically. The best way to deal with a QSA is the open one. Raise any problems openly and discuss them factually. Again: open and factual! If you know that a compliance problem may be lurking, the best thing is to address it right away - right at the beginning. Why? Because then you have nothing left to hide and an auditor can no longer find anything you did not know about already. If you did your homework properly during preparation, he will find nothing at all. Ideally, of course, there are no problems at all, but that is not always the case.
This approach creates some trust between the parties and can make the audit immensely easier. Auditors have to bring a certain basic skepticism to their job, that is unavoidable. Whoever discusses things factually, honestly and openly will come out better overall than someone who closes off and picks pointless arguments they can only lose. Simply see the auditor as a partner ;-).