Store the audit result in their database, flagging accounts which are detected as having suspect results for more manual review. If they recorded up till when the last audit had parsed an account, they wouldn’t have to rescan an entire account on subsequent checks of new data.

I wonder if their unwillingness to do unprompted scans themselves highlights a fear internally that they will find a lot of errors? … or perhaps they have and they’re quietly fixing the bugs without telling anyone or correcting the accounts until they’re called on it? (This is purely me wondering what goes on and shouldn’t be considered me saying this is what’s happening)