From my experience auditing companies seem too erratic too in their findings.
At an old job we had one Auditing firm (Deloitte or KPMG??) auditor who found a lot of issues. The auditor found a single cash register receipt among a year's worth of receipts, a pile, with the login name the supervisor not the employee. The supervisor forgot to log off and an employee used the cash register for one or two sales.
A new auditing firm the next year found no issues which I knew was bull since the place changed over staff a dozen times and new management was far more incompetent.
At an old job we had one Auditing firm (Deloitte or KPMG??) auditor who found a lot of issues. The auditor found a single cash register receipt among a year's worth of receipts, a pile, with the login name the supervisor not the employee. The supervisor forgot to log off and an employee used the cash register for one or two sales.
A new auditing firm the next year found no issues which I knew was bull since the place changed over staff a dozen times and new management was far more incompetent.