Learn in the textbookSignificance, Types, and Structure of Systems Auditing
DefinitionAn information security audit (情報セキュリティ監査) independently verifies and evaluates whether the controls protecting an organization's information assets (情報資産) match the risks and are working effectively.
ExplanationControls here mean measures such as access restrictions and rules on taking information out, which keep the confidentiality (機密性), integrity (完全性), and availability (可用性) of information. The auditor checks not only whether rules have been set but also whether they are actually followed.
AnalogyIt is like an inspector walking through the office and checking not just the safe keys and entry logs but also papers left lying on desks, to see whether company information is properly protected.