Can someone explain to me how the EU is planning on enforcing GDPR on US-based companies? And even with EU companies, without some kind of third party auditing

Can someone explain to me how the EU is planning on enforcing GDPR on US-based companies? And even with EU companies, without some kind of third party auditing, how can you actually believe anyone's privacy policies which claim to conform? What's actually preventing everyone from just claiming that they are following it, and then secretly breaking the rules?