An audit is a structured, independent examination of whether an organization's security controls, policies, and practices operate as intended and meet defined requirements. Internal audits are carried out by staff who report independently of the functions they review, while external audits are performed by third parties such as certification bodies, regulators, or client assessors. Both provide assurance that the security program is doing what it claims to do.

Within governance, audit is the verification mechanism that closes the loop between policy and practice. Leadership sets direction and defines controls, operations implement them, and audit confirms the results objectively. This independence is what gives audit findings credibility with boards, regulators, and business partners.

A typical audit follows a repeatable process: planning and scoping, gathering evidence through interviews, document review, and testing, evaluating that evidence against a standard or control set, and reporting findings with severity ratings. Findings describe gaps between expected and actual conditions, along with recommendations.

Follow-up is as important as the audit itself. Each finding should be assigned an owner, a remediation plan, and a target date, then tracked to closure and re-tested. Without disciplined follow-up, audits produce reports rather than improvement.

References#

• ISO/IEC 27001, Information security management systems, which specifies internal audit and management review requirements.
• The Institute of Internal Auditors (IIA), International Professional Practices Framework.