Privately owned ATM's (the Canadians call them "white" ATMs) are an issue. However, your auditor is apparently assuming a "canned" response is appropriate. Your response, determining ownership, servicing, etc. is what is necessary. It's about analyzing the risks, not about acquiring pieces of paper.
_________________________
In this world you must be oh so smart or oh so pleasant. Well, for years I was smart. I recommend pleasant.