Tokens on a company balance sheet may or may not be held by a third-party custodian, whose statements the auditor might or might not consider reliable. A company choosing self-custody is under no obligation to make its wallet addresses public, and might not be honest about who else has access to the private keys.