Soc2 compliance, Audit