That's what an (effective) audit is, conducted by technically-competent auditors. These do exist, and while some of their checklists include some bullshit, not all of it is bullshit when there are qualitative reviews of exceptions and of the soundness of processes.