This happens all the time, I worked for a company that was audited by a security firm. The security firm compromised every part of the company by pretending to be employees, third party vendors or competitors looking to hire away current employees. Some of their existing employees gave away every single detail you'd need to compromise the infrastructure during interviews.

Fooling auditors isn't going to be all that difficult, most auditors get confused if there is too much going on in the room . I've literally seen a publicly traded company pass an audit just by making the audit frustrating and then providing every perk you can imagine outside of the audit room (including attractive men/women). As you can imagine, they didn't do a very thorough audit.