From my experience with dealing with internal audits, the purpose of it is to prepare the company from a major audit that would occur by the FDA. It allows the company to do a thorough search to find potential holes and gives the company time to address any issues. So when the FDA rolls around the company would pass their audit. For example, recently the company I work at conducted an audit on our DHF. During that they noticed, that software verifications of requirements were done on different iterations of software because as new software is released there are new functionalities to verify against requirements. So the justification or design review of notifying why it was acceptable to have verifications on older SW iterations, was not enough. More in depth analysis of the code to show that the functionality that was tested on older software was not touched as newer versions of software was released would be required to be proven.