reality -> accounting books -> financial statements
The auditors don't look at the first mapping "reality -> accounting books" but only at the second one "accounting books -> financial statements"?
And even in the second mapping, they check with a sampling-based approach?
Additionally, pretty much 90% of an audit flows through a limited number of client contacts. Audits are not designed to defend against a concerted effort to prevent the auditors from seeing 'reality' (i.e. un-doctored documents), due to the manpower requirements to validate information at that level.
Conceptually, it's the difference between 'I-trust-you-but-I-need-to-check-that-you-did-your-homework' and 'Trust no one, everything you see is a lie'.
That's not entirely correct. A good portion of SOX audit efforts in the US, for instance, is spent on examining configuration of the various systems on which financial reporting is dependent (e.g. examining exactly how segregation of duty controls are implemented in the ERP system). A good portion of time is also spent examining if human-executed processes (e.g. employee on boarding/off boarding, granting permissions to data and financial system capabilities, manual review of backup job reports, etc) are actually being carried out in a manner that complies with the organization's SOX controls.
You have to understand that the underlying concept of audit that a small team of auditors is responsible for ensuring that a huge (relatively) company is going about things correctly - there's no way to obtain a 100% assurance with that scale of manpower, and there's no appetite from companies to significantly increase the audit fees to obtain that level of assurance. Instead, a sampling/risk-based approach is taken in order to ensure that there cannot be a large error within the financials.