The broad exemption for "transaction or relationship messages." Based on your characterization of your messages, I'd say they are totally exempt from CAN-SPAM.
The auditor said it was a CAN SPAM guideline....
Issued by whom? Under what authority? Cite?