A security audit involves assessing how effectively an organization has put its information and system protection policies and procedures into practice. For example, an auditor examines whether a company maintains administrative control over its mobile devices as part of the evaluation process.