>If a company states in their investor quarterly report that they had 1M active users, they better be able to prove it in an audit.

Is this even legal? I've never heard of a company letting an outside firm go through their database to confirm any sort of statistic like that. Who is doing this auditing?