You are correct. The auditor must be engaged by the company being audited (and paid by them). A bank can hire an auditor to assist with their loan due diligence, but that would be completely different from hiring an independent auditor who audits the company's public filings and issues an audit report thereon.