I suggest that you start with the internal auditor, who should see all documentation. Provide him or her with specific details of your concerns, with as much evidence as you can. The external auditor sees the AGAR and the internal auditor's report.
During the audit period, there will be a period for public rights when you may raise concerns with the external auditor, but you should read the guidance notes on public rights before pursuing this option.