Sure a legal audit is standard and usually much simpler than a full source audit for security, which has a complexity proportional to the project size.