First point - you need to check into the blacklisted auditing firms. Just like tickers go black so do companies that are shady in their diligence.
Second point - companies can self-audit as well, meaning the CEO/CFO certify. There is no need for independent third-party auditors. But, just for my own amusement here is a fully audited company that was a scam and the amount lost in lawsuits that followed.
Enron $7,200,000,000