I find it alarming that an audit company has to ask that, since they're supposed to know it.
"staff" is the default group when you create an user without specifying a group, other than that it has no special meaning.
As to being assigned to parameters that grant high privileges, it shouldn't be done, for the same reason that you should do the same with the "users" group in linux or the "Everyone" group in windows.