Earlier quoted context omitted.
You don't need to get an Audit for Compliance with GDPR. Whoever told you that was scamming you
When you don't know what you're talking about, an option you always have is to be silent. I suggest that you exercise that option next time. At the time I was doing this, it was part of a very large company that quarterly ran audits of all their own systems for security and legal compliance, and they did GPDR as one of their things to audit against. So we were not scammed, we had our internal employees do their job.
It was their own choice then.
GDPR doesn't require you to perform audits, unlike other Regulations or certifications