If you use the View Permissions feature to list permissions on CPAN-Audit, it says that VTI has first-come, and co-maint for BDFOY, BRIANDFOY, RENEEB. But if you look at the individual packages in CPAN-Audit, they all have first-come for VTI and co-maint for BDFOY and RENEEB (no mention of BRIANDFOY).
There is another module CPAN::Audit::DB which is in distribution CPANSA-DB, and that does have the permissions reported for CPAN-Audit. CPAN::Audit::DB was previously part of CPAN-Audit, so I'm guessing that's why PAUSE is confused / lying.