that's the central conflict of interest revealing itself right there (of auditors being paid by their client). it's in the best interest of the auditor to ignore potential fraud so as to have plausible deniability in any legal actions.

while financial audits are primarily focused on how good the numbers match up and how well the controls in place help to do that, an audit wouldn't be done if it weren't for the potential for uncovering fraud up and down the hierarchy.

forensic accounting is also a thing, outside of government.