Most PCI audits are not mandatory unless you have had a breech that compromises data. Before that "self-certification" reigns.