Auditing systems and methods detect access authorization of a media device for a service during an audit. An exemplary embodiment receives an audit trigger at a media device communicating the service to a media presentation device, determines whether the media device is authorized to communicate the service to the media presentation device, and communicates a security watermark from the media device to the media presentation device. The security watermark is displayed on a display of the media presentation device and indicates authorization to access the service to an auditor performing the audit.