Because $$ auditing every part of an organization and extending into all outsourcing partners may not be possible.

of resource constraints

all users should be informed they are being audited

all users should not be informed they are being audited

such an extensive audit is outside of best practices recommendations