The potential for conflict of interest with the same person selling security equipment who is conducting the audit is poor. The only way around this is independent certification of security products to determine whether they are compliant as per PCI standards. The ONLY company which is doing this right now to my knowledge is NSS Labs (out of Chicago). NSS has a long history of security testing and certification and, more importantly, appears to be the ONLY independent security testing and certification facility which is truly independent (i.e. is not owned by or affiliated with a company with a vested interest in selling security products or managed services). One of the vendors we use is already going through the NSS PCI certification process and it look pretty good - will certainly be of use to us in the future when it comes to selecting security products to maintain our PCI compliance.

Click to read the article this is in response to.