Introduction The role of audit in the information security management is to review and confirm the compliance with the organization security policies, business and legal regulatory requirements; to confirm that confidentiality, integrity and availability of information is assured. The audits generate reports that can be used by the management to verify if the assigned security responsibility and authority to an individual is being performed well. Audits find faults in the organization IS system policy/control. An audit is also performed after the fault has been fixed to confirm the reliability and effectiveness of the fix. An audit can be conducted when new security policies are drafted, new information assets are identified, new regulatory compliance requirements are issued, new employees are hired or on a periodic basis to review and keep a watch on the implementation of security controls. In the “Plan-Do-Check-Act” (PDCA) model for Information Security Managment System (ISMS) audits are part of the “Check” phase. The “Check” phase is executed to check security activity in all the other three phases. In the “Plan” phase the audit is conducted to ensure that security policies have been defined for all security requirements and regulations. In the “Do” phase the role of audit is to confirm that security methods are implemented and controls are executed. In the “Act” phase audit confirms that the security incident has been correctly fixed. PDCA is a sequence of phases; every ISMS process passes through all these phases. Example: the PDCA is executed in the “monitor” process; plan-do-check-act within “monitor” process. Types of Audit Internal Audit These audits are conducted for the internal use of the organization. The auditors for internal audits may be internal staff, or external agency hired to co-work with internal auditors; an auditor must not audit the security controls he/she is responsible for and must follow the standards and guidelines specified by IIA. The internal audits are conducted to determine if the security controls (ISO/IEC 27001):  1. Conform to ISO/IEC 27001 requirements, organization business & legal regulation requirements.  2. Conform to the organization information security policies.  3. Are implemented effectively.  4. Perform as expected under all circumstances. The internal auditors must confirm that the management has acted appropriately on the recommendations of the previous audits, internal or external. The internal auditors also have a role to evaluate controls and information security safeguards in the event of organization merger or acquisition (I&E AUDIT, 12-15). External Audit The out-sourced internal audits are not considered external audits. The external audit is conducted by the independent certified auditors from an external agency. The advantage of external audit is that it provides management with:  1. Reasonable assurance and reliable report on the effectiveness of internal controls.  2. An independent & objective view of organization business processes.  3. Feedback on organization risk management process. When hiring an external auditor, the objectivity of the auditor must be confirmed by verifying the auditors credentials such as experience, qualification and relationship with any organization emp