Can the BSI audit our company?
Yes, if you are in scope, in ways that depend on your category. For particularly important entities, the BSI can order audits, checks or certifications by independent bodies to verify the risk-management measures, the reporting duties and management training (section 61(1) BSIG); from three years after the law entered into force it can require evidence of compliance from other particularly important entities (section 61(3)); and it can inspect compliance itself, with the right to enter business premises during normal hours and to see records (section 61(5)). For important entities, the BSI checks compliance and can take the same measures when facts suggest that duties are not being met (section 62). Operators of critical installations must provide evidence through audits, checks or certifications every three years (section 39). Keep your documentation of section 30 measures ready, as section 30(1) requires it anyway.
General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.