This story doesn't make any sense. An FTC-mandated E&Y "Privacy Audit" isn't a software security assessment and would never have been expected to either (a) uncover subtle application security flaws or (b) metabolize internal reports of subtle, fixed flaws. Nor, for that matter, is the internal discovery of a software security flaw a "breach": routine internal discovery of vulnerabilities is what good security teams do.

The reporting on this G+ story has been startlingly bad. There's apparently some juice to the narrative that Google is running headlong into a collision with the Trump administration, and so reporters seem to be starting with a public policy conclusion and working their way back. Somebody needs to start informing these people how professional software security works.

In any audit situation --- PCI, HITECH, SOC-2, you name it --- there is neither a norm nor a duty to notify auditors of internally discovered security problems. Nor would any such norm be productive: it would warp internal incentives, both to discover and to properly handle vulnerabilities.

If the auditors discover a security problem, that problem gets documented, just like it (typically) does with external reporters (researchers, bug bounty claimants). When that happens, you have an indication that your internal software security controls failed. But when your team finds a bug in its own code? That's a sign that the team is doing things right.