Is auditing a BIP32 tree only possible if it is non-hardened?
That is correct, you can only do this with non-hardened derivation. Only non-hardened derivation can use the master public key to derive all of the public keys. With hardened derivation, you must have the master private key in order to derive anything.