I don't see how audits work well in this situation. I wrote more about what ad fraud can look like in this comment [1] and I don't see how an audit would catch "as a publisher, one of our traffic sources is sending us bots instead of real visitors".

[1] https://www.lesswrong.com/posts/dFgfQTo4DRZG5t8Ap/can-ads-be...