Since they are also a root CA, are they allowed to audit themselves, or do the browser root programs require third-party audits?

I can't imagine one part of a business being on the up and up, and the guys down the hall running completely rogue.

Third party audits from a qualified auditor are required, although the CA chooses and pays the auditor, and the auditors are basically just accountants. So it's... not a perfect system.