Who is the security auditor?

Security audits are a way of examining a system, policy or process for violations and exposures.

Auditing is the process of ensuring that the information processing system (hardware, software, liveware, middleware, policies, and procedures) complies with the installation security policy. Auditing may be:

A one-time project such as a snap inspection, or
An ongoing process pursuant to policies.

Security audits are a catch-all that have been used for actions ranging from checks on physical security to implementation of the information security plan.

The two types of information security audits can be termed preemptive and reactive. As their names indicate, preemptive audits test security controls. Reactive audits respond to potential security breach events.