Audits can't account for a company acting in bad faith to mislead an auditor. It accomplishes two things- 1. ensure that the company isn't misconfiguring thing

Audits can't account for a company acting in bad faith to mislead an auditor. It accomplishes two things- 1. ensure that the company isn't misconfiguring things and accidentally breaking their own policies 2. provide a paper trail that would directly implicate people in the event of fraud, removing plausible deniability for the folks involved.