A third-party audit can prove that the system functions as shown without a hard drive, and a third-party auditor can, using contractually-authorized random unscheduled spot checks, physically inspect the live deployed servers to confirm the absence of any disk media.
Third-party audits prove something. They don't prove everything.
