Outside of financial audits, there are two other audit types that organizations do.

1) Audit of your process and procedures
-> This is the most easily understood. You are audited for your compliance with your documented processes and procedures.

This an ISO Audit but has broad applications outside ISO standards. Do you do what you say and say what you do?

2) Audit of your process against industry best practice.
-> This one is the trickiest. "Best practice" can often be consensus opinion without studies or research to confirm that.

Both are common practice now. And sometimes they can be mixed. I don't know what the AG did, but as far as "best practice,"

It is now long accepted that only doing financial audits will not benefit any organization in the long run. It means deliberately ignoring institutional problems.

So arguing that the AG is over-reaching their authority is an argument for ignoring institutional problems in gov't.