When I worked as an attorney for a bank one of my jobs was to "manage" the audit engagements. When an audit has serious findings you can almost guarantee that's just the tip of the iceberg. On the other hand, an audit or review without any findings just means the company under review had some combination of good lawyers and friendly auditors.

In my experience, there are two types of firms you can almost always find "friendly" auditors: law firms and small specialized "boutique" firms (accounting, consulting, etc). Who conducted this review? A boutique law firm.