sharepoint audit scope/healthcheck

Have you seen this resource, it's a good place to start:

https://docs.microsoft.com/en-gb/office365/securitycompliance/secure-sharepoint-online-sites-and-files

There also some great resources here around security, like Office 365 Information Protection for GDPR with guidance and recommendations, though it may not all be relevant. 

https://docs.microsoft.com/en-gb/office365/enterprise/microsoft-cloud-it-architecture-resources

CRIB111 This is predominantly for SharePoint Online, so it won't be as relevant if you are on SharePoint Server, though some of the concepts will still apply. In that case, start here perhaps - https://support.office.com/en-us/article/configure-audit-settings-for-a-site-collection-a9920c97-38c0-44f2-8bcb-4cf1e2ae22d2 and https://support.office.com/en-us/article/view-audit-log-reports-b37c5869-1b47-4a82-a30d-ea20070fe527. This seems to be a reasonable overview - https://blog.syskit.com/sharepoint-audit-logs-management. Finally, this may help - https://docs.microsoft.com/en-us/sharepoint/sites/overview-of-security-groups-in-sharepoint-server and some of the resources linked from there like https://docs.microsoft.com/en-us/sharepoint/plan-your-permissions-strategy.