It struck me that both in this case and Theranos, they exploited the weakness in "sampling audits" where external parties are shown only a sample of the product

It struck me that both in this case and Theranos, they exploited the weakness in "sampling audits" where external parties are shown only a sample of the product on the faith that the rest of the inventory is the same. Like showing a few machines and switching around the serial numbers here, or in Theranos case showing one blood test machine but not the off-the-shelf tester actually performing the assays. It's actually pretty difficult for an auditor to do an exhaustive search - what would they do, ask to visit 3000 machines?