I had friends at a company with serious security breach. There was a hullabaloo, all sort of important people in the company upset and questioning whether they should fire the head of tech. To calm the waters, the head of finance hired an outside firm to investigate. All good, right?
Here, the head of finance liked the head of tech and trusted him. The outside firm, knowing who buttered their bread, fished around for clues on how the report was supposed to land. And as expected, the report was, "some flaws, a couple of dumb mistakes, but basically sound." From the same facts, a hostile auditor could have come to the opposite conclusion, that the dumb mistakes were indicative of deep flaws and the whole company was put needlessly at risk.
Specialized audit companies have to get paid. They claim to be neutral parties, but they have an inherent conflict of interest. If you choose the right one, you can get a better result than an internal investigation. But you can also choose one that serves the interests of whoever's paying the bills.
Independent investigation is great, but you're right to observe that "outside" is not necessarily "independent". I suppose there are a few solutions to that: you could break the financial link (in the bond case, get consumers or the government to pay raters), or you could establish a culture where inaccurate results destroy reputation.
I'm sure there are auditors who do objective work for the people paying them simply because they value being known as reliable (and who are hired because the auditee wants a result people will trust). Without some precedent, we probably shouldn't assume that rosy case is happening.
When one company is making a sale to another company, not always, but sometimes, the sale is made by exploiting an inside political conflict. Sometimes the purchase is a prize in a proxy battle between two factions. Sometimes, it is to get some independence for one group from another. Sometimes, software is used to enforce the will of one group on another.
The outside firm, knowing who buttered their bread, fished around for clues on how the report was supposed to land.
The market has spoken.
Is that really true? Presumably they're being paid by the company. And, in a large enough company, these kinds of things would come up decently often. If the auditor has a few investigations in a row where they find against the company, wouldn't the company start looking for another auditor?
They contracted a specialize company to investigate, collect the facts and present their conclusions. The conclusions would be sent at the same time to the alleged victim, the HR and the manager.
In this case the conclusion was that there was no harassment according to legal definition. These argumented conclusions would have been presented to a trial as reference if any party would want to contest them.
The company performing the audit is specialized in it. So they can recognize a real harassment from an abusive claim. They also have no interest in the company. It is in the interest of the company to call them to get a leverage to apply whatever measure they would find appropriate. If the victim is an employee, and he/she would consider the reaction inappropriate and abusive, he/she could complain to a tribunal.
Today, a company that is not reacting like that (diligent an investigation by an independent party) to a harassment complain would be considered a priori suspect or would be consider to have failed complying to its duty because it is their responsibility to do so.