By examining the firewall logs, which are a record of every attempt to connect, those that are dropped and those that are allowed, it is possible to compare them to the firewall policy and discover unused rules.
This makes it difficult to audit the firewall, especially since many of the policies are not well documented, and too many rules can impact performance.