It makes a lot of sense to give the auditors full read-only access to the company records so that they can do substantive testing easily

However it makes NO sense to grant posting access to auditors - it's not their job to make changes to the accounts. In fact that is the OPPOSITE of their job, and is dangerous in case a junior auditor changes something in the books by mistake.

Surely QB could offer an Auditor user type that could be granted temporary read-only access to the books