It's not true that "X could be useless" implies "X is useless". If your
expectation (in a probability sense) is that X is useful, a policy of requiring X is, broadly speaking, a better idea than a policy of not bothering at all.
In the specific case of auditors, they tend to be large, well-known companies with a reputation, a common system in our society for figuring out if people are useful or criminals. Arthur Andersen, for instance, made a series of bad ethical decisions in its accounting audit practice. They no longer practice auditing for accounting, and their consulting business has been rebranded (to Accenture) because they lost the reputation of their original name. So they did, in effect, get audited eventually. Which again is better than not bothering.