US and UK companies with foreign operations use audits to prevent worker abuse – but auditors say the checks aren’t working