Agree that RoHS applies to packaging.
I'm a little concerned about the recommendations for lab certificates. There is a time and place for testing, but if a supplier sends me a certificate from a lab and claims to be RoHS compliant based on the single test of one item, I simply cannot accept that.
You need to have a SYSTEM in place to ensure your products will continue to be compliant. Testing is a part of that, but you certainly don't have to test every unit that goes out.
You need a system that evaluates what you suppliers are sending you, usually some sort of risk assessment. We do this through a qualification process. Then you should have (need to have?) some sort of monitoring process to ensure continued compliance. Of course, this implies that you have corrective action and containment processes that you can use to address any violations you uncover during randon sampling.
We only ocassionally send items out to a lab. More frequently, we monitor using an xRF analyzer. These have their limitations (can't tell Hex from non Hex Chrome, or the source of Br, etc., since it's an elemental analyzer), but are good for risk assessment. If anything turns up suscpicious, the supplier needs to provide a reasonable explanation (and evidence if appropriate).
Sorry for a long winded answer, but it's kind of an involved topic. The simple answer is yes, there is only self certification and audits are not required by the letter of the law. All that matters is if the parts are compliant or not when your ink gets checked at customs.
You are not required to "audit", but a strong program (and hence low risk) will include either auditing or monitoring. If you are found to be non-compliant during a customs inspection, it will matter if you performed due diligence or not. It will be difficult to show due diligence if you aren't checking (read auditing/monitoring) periodically to ensure your compliance system is working.
Hope that helps.