Tough question... which is also why developers mostly do not voluntarily build authority-checks into code... particularly if they don't have much confidence or knowledge about the implementation of the authorization concept.
We built our own tool which scans the code for data used in it and is output back to the surphase again. It then scans for corresponding auth checks and how the program stack deals with it.
It then suggests the symantically correct object to check or central FM to call and the coding location it is best suited to be fit into.
This helps a lot if you have a big mess or the developers need content to suggest solutions to them.
For individual programs, you can also get by if you understand the code and the authorization conceot and the data.
Cheers,
Julius