I am not sure why it could be a GDPR conflict, the auditor is not an employee, someone with whom they have a contract (and in most cases Parishes share the same national audit firm).
The auditor must be approved in the minutes and their audit report available for public inspection, I can't see a reason why it would not be public information.
The only exception I could see was whether having on a website ), under a 'contact us' section would lead to residents to contact them to complain to about the Parish in the first place instead of to the council.