Hi there,
I do a back link audit for my clients annually, just to ensure I have a good idea of what links have been created every 12 months that may be out of my control.
I usually pull all the links from as many tools as I can; Open Site Explorer, Google Search Console, Cognitive SEO, Ahrefs, SEMrush etc and compile them into a Google Sheet.
You'll find most of these tools will have some sort of gauge to show you the trustworthiness of each link, however I still find it's good to scan through them manually. You get a good feel for which ones are fishy after a while.
From there I go through them manually, to see if there's any really worrying ones (I also highlight ones to keep an eye on).
If there are ones I want removed, I will attempt to contact the webmaster to do this.
If I cannot remove certain links and I believe they are harming the site (typically it would only come to this if there is a manual penalty) then I'll look to disavow those links: https://support.google.com/webmasters/answer/2648487?hl=en
I hope this helps