Your question is targetting two subjects:
First, the use of 'another site that does not have an equitable set of physical and logical security controls' in the case of assets within the scope has to be documented. This is usually done in recovery plans/contingency plans.
Second, you do owe the auditor nothing. However, if you have an incident and you see that this incident makes your break the rules you had certified (example: the servers have to operate in a room controlled by physical access restriction), then you have a "non-conformity". Non conformities are usually qualified as minor or major. The number of these non-conformity raised by an auditor will decide on the renewal of your certification.
Corrective actions are means to correct the non-conformities you raise. Failing to do so will allow the non-conformity to stay and potentially be raised during a future audit. The corrective action should address this by either:
- create new rules (example: create a document for recovery stating that when this type of incident happens, servers can operate in a degraded environment for some times),
- modify the rules,
- or investing in more resources (having a backup server in a proper room with physical access).
If you follow your rules and keep correcting yourself when there is failure to comply, there should be no problem regarding the certification. After all, this is what ISO27k says you have to do.