Who would do an audit?

Because the obvious candidate is Serpro, but they are already developing it. Anyway, it's open source, so if any part of the government (military maybe, ABIN, or some university) thinks that it deserves an audit, it can simply do it, no need for formalization.