Is it possible that prior staff at companies like Microsoft may have injected backdoor vulnerabilities?

How is this auditable?