It can be a useful technique for testing the quality of the audit. At a previous company we had to have words with a company that performed a software audit as

It can be a useful technique for testing the quality of the audit. At a previous company we had to have words with a company that performed a software audit as they failed to find two issues we'd planted to test them. (Of course, they did find several things we didn't know about.)