Think about it this way... Every supplier you have might be able to fuck you in one of 1,000 ways.  If you have 1,000 suppliers that's 1,000,000 possible sources of fucking.  Your audit department can check 10,000 possible sources per year.  That's your capacity.  That's what your Q&amp;A is budgeted for.  Its also commercially standard.

Now, if you are willing to make some fairly basic assumptions about your supplier's level of honesty you can check off a ton of the ways they might fuck you with a simple form they sign off on.  Of the 1,000 ways they might fuck you probably 200 are not really "problems" in the western world in the first place and so you accept a simple form.  You can quickly get to the point where instead of 1,000,000 sources of fucking, you are down to 100,000 and you are now basically auditing everything once every decade.  That's pretty good.  Better than once every century.

But it requires you to rely on your suppliers to some basic degree.  To assume that people will not actually lie but will just omit certain truths.  That people will not fake results and forge documents, but will just bullshit and talk themselves up a bit.  

If I say "do you have insurance?" and you send me an insurance certificate it would be very rare for me to go to the insurance company to verify it - I'll just assume you are not a total piece of shit and didn't fake the document.  

A full audit with zero trust would require a huge amount of resources that are just not available.