At what point should I push for a code audit? I don't think any of the codebases I worked on ever had a "real" audit. Best case was reviews pre/post acquisiti

At what point should I push for a code audit? I don't think any of the codebases I worked on ever had a "real" audit. Best case was reviews pre/post acquisitions. An external audit seems like a good thing, but I have no idea how to argue for such a thing.