Which to me indicates that there was probably no documentation made if they did happen, so it would be impossible to audit like two years later, because being ignored when she told someone about the sexual harassment was one of her complaints.

When a law firm does an internal investigation, it’s about judging the risk to the company if things were to go to court and not about if the events actually happened. So things like a lack of documentation is exactly what they are looking for. By using someone that can be considered to be a neutral third party, they can get the accuser to divulge whatever evidence they also have. You’re not lying, the firm isn’t there to make you look innocent, but you are clipping the leverage of the accusing party.

So, if the accuser says that they have a journal, or witnesses, or recordings, then you as a corporation then act to stop them from pressing forward. You fire someone, you pay them out, you say “oh, if only I knew about this we would’ve done something sooner”, etc. This generally costs less than actual court and what would be ruled against you.
If the accuser has nothing, and you also have nothing that would shake loose in an actual investigation for your requirement to provide a safe workplace, then you can say things like “look, we paid someone to look into things, and it is looks like we’re all good. We’re going to put some policies in place to make sure that IF something like that every happens, that we can…”

It’s like a voir dire without the actual trial. If things go to trial, well, you already know what your defences are.