IT audit finding for self-identified issue

Hello,

Newbie sysadmin here. Apologies if this is a basic question.

We are going through an internal and external pen test. There is an issue that the bank's IT team had self identified, reported to the IT Steering Committee, and submitted to board with a project plan and completion date that is scheduled for after the audit is completed. The auditors have dinged us with a finding for this because it is outstanding as of the date of the audit, but we believe because it's been self-identified, documented, and the risk has been acknowledged, it shouldn't be a finding or at least be seriously considered in the equation.

In your experience, have auditors written up /not written up your org with a finding for a self-identified and scheduled update to resolve an issue or risk?