Audit Basics

Summary

The formal process of independently verifying that security controls actually work as documented — internal audits self-check, external audits (often required for compliance) are performed by a third party.

• 1Read about what evidence an auditor typically requests to verify a specific control.
• 2Learn the difference between an internal audit and an external, formal compliance audit.
• 3Understand why 'documented but not actually followed' controls are a common audit failure point.