As part of a a security audit, a customer has asked for some documentation - usual stuff - data classification policy, incident management policy etc. They have also asked for a blank employment contract. I don't see what use this could really be to a security audit, what is it they are looking for in this document?
Employment contracts do things like describe limits of liability, employee responsibilities, remediations, punishments, etc. There's a lot in there that will tell an auditor about how the company views security and data protection.
As someone who had to supply all this documentation, it was not an unusual request from 3rd party auditors.