Definition
A compliance audit is a systematic evaluation to determine if an organization adheres to specific laws, regulations, standards, or internal policies. It involves reviewing documented procedures, operational practices, and security controls against established requirements. This process ensures accountability and verifies that the organization meets its legal and ethical obligations, thereby mitigating risks of penalties and reputational damage. For instance, a financial institution might undergo an audit to confirm it follows the Payment Card Industry Data Security Standard (PCI DSS) for handling credit card information. Unlike a vulnerability assessment which identifies weaknesses, a compliance audit checks adherence to predefined rules. This concept is frequently tested on certifications like Security+, CySA+, and CISSP.