It's not quite the same to describe something that already exists, as opposed to describing actions that have or have not happened yet (nor will they for the duration of a policy lifespan). Auditing ingredients is _relatively_ trivial to trying to audit the amorphous "privacy" restrictions.