For any real audit of website traffic (M&A, large advertising deals, etc), you typically don't rely on self reported statistics, but rather 3rd parties (e.g. SimilarWeb). These have actual spywares on top of Google analytics plug-ins to correlate real traffic from noise