If there is some credible reason to believe this might be the case, then an audit should be done. Carefully, not recklessly. With oversight, especially if the auditor gets write access to anything. That oversight should include, at an absolute minimum, a system, not controlled by the auditor, that logs every interaction with the system being audited.