"I think these audits are released to the public as I remember Let's Encrypt doing so, but that may just be because i) they aren't a full blown directly browser

"I think these audits are released to the public as I remember Let's Encrypt doing so, but that may just be because i) they aren't a full blown directly browser trusted CA or ii) LE just decided to do so as it fits their ethos." Head of Let's Encrypt here. We're required to publicly disclose our annual audit reports, as are all publicly trusted CAs. No comment on this particular situation since I don't know enough about it, but I'd expect any organization with a publicly trusted intermediate to have a CP/CPS publicly available prior to getting the intermediate.