Screw the audit. Go further. Seize machines. Raid the company and get the source code for all revisions of their software. Interview all employees, especially the coders. Examine the code running on the machines to determine when it received its last update. Decompile the code running on the machines and match it against the company's declared current revision of software. Look for back doors. Dig deep.