Putting my former auditor hat back on...

The auditor is (or, at least, should be) looking for ways to mitigate a risk that they've identified. For the first step, I'd ask the auditor in question to clearly spell out the risk or implication that they've identified.

Second, in audit terms, there's a concept of a mitigating control. Say management says the risk is acceptable to them, then you would want to demonstrate mitigating technologies/processes/etc. that reduce the risk that the auditor identified for having the root account in place.

Things like audit trails of who uses the root account (maybe you only let local users switch to root through `su` instead of permitting network based logins that you can't identify the source user through), automated tools that reset the root password when someone needs to use the account (i.e., Bob requested root for this purpose, so the system will set the password for him and regenerate/scramble the password after a certain time window), etc.

-M