Some of the assertions made above about lack of auditability seem quite misleading to me. Yes, the security properties rely on cryptographic assumptions and on the parameter generation having been performed without leakage of secrets. Bitcoin also relies on cryptographic assumptions; if there were a break of ECDSA, for example, then value might be spendable without knowledge of the private key (or private keys might be obtainable by an attacker). The differences are not fundamental.
If the OP was asking about how balance is enforced despite notes being encrypted, the answer is that a cryptographic hash is used to publish a commitment to each created note, and the zero-knowledge proof ensures that for each JoinSplit transfer, the total amount specified in these commitments (plus the transparent output) matches the total amount spent from the inputs. The enforcement that the plaintext of notes is correct is done only when they are decrypted. (We actually considered a protocol change to ensure that the ciphertext can be publicly verified to have been encrypted correctly, which is technically feasible – but this was not necessary with the feature set we settled on.)