What makes you think this was the first audit? Shipping a bug doesn't imply that zero QA was done.