Independent audits do two things. They examine process, and create an environment where you have to operate in a sane manner, because your auditor can drop in at any time, pick out any particular starting point, and will expect to be able to have delivered to them where that transaction came from, and ultimately will go to based on GAAP and in house supporting process documents. This basically draws a complexity boundary around how exotic you can get within the context of one organization, because if one of the big independent auditors can't make heads or tails of you in a reasonable amount of time, it is a gigantic red flag w.r.t your operational processes.
An audit also results in a snapshot of your entire cash/value flow through an organization. This is verified and cross checked for valuation by someone who doesn't know you from Adam to ensure objectivity. This is just a guarantee that the numbers add up, and over time continue to make sense. Massive discontinuities that can't be ascribed to something in the real/business world measurable by someone else are also red flags that there may be something going on there that may be valid, but you need more info to get to the bottom of it to ensure it is sound.
t. Quality Assurance person who has spent entirely too much of his life digging into how finance works even though they allegedly hate it, but a statistical analysis of how much of my mind I devote to financial analysis, modeling and prediction tells another story.
Ironically, if you mentally audited my thoughts you'd easily come to the conclusion I love finance. I don't. I like measuring things. Measuring finances effectively is a pain in the ass, and a perennial issue, that there are more than a few groups constantly working to frustrate people like me who try to distill truth out of account ledgers.
That's why numair is absolutely right. An attestation is one slice. You know money was there. You don't know where it went afterward, which subtransactions it spawned (fees, taxes, interest accrual, etc...). That's what auditor's look at and collate. It's why it's a big deal. At the end of the day it's all arithmetic, and an audit is just having someone else run the numbers and vouching they get the same result. It's actually a little more than that, because regulation wise, the auditor's number is more reliable than yours, because they have all the incentives in place to keep their processes and interpretive liberty taking to a minimum. You want to match the auditor's numbers if you can coax your process into doing so... Of course again, there's arms race there as well. Note, auditor's don't find or investigate fraud. They just check your process is being followed, and that when someone else does it, everything works out. It just so happens that this is also a great way to shake out anything that might be used to as a basis to make fraud effectively doable.
It is a rabbit hole. One that I've explored many branches of, but after a while doing it, you can pretty quickly measure how uncomfortable a group is by their level of nervousness around letting an auditor drive.