There were several incidents where it took leaks and third-party releases for the truth to come out, and if they'd done a big audit they'd have announced it for the "we're taking concrete steps" cred.