Rookie All you need is a second Android phone (doesn't have to be GrapheneOS) and a few QR codes will appear which you will scan from one phone to the other.
The first time you will see a yellow screen which shows the initial pairing. Doing the verification from then on will show a green screen if it is a good verification.
Note that this is best to do as soon as possible after install to ensure a good chain of trust. You should also know that the Auditor app is not foolproof. It is entirely possible that a profile is compromised due to a malicious app that did not cause any real tampering, causing Auditor to not detect the compromise. If this is the case, you can try to find the source of the compromise and remove it, or delete the profile if possible.