Auditing in information system security involves assessing and evaluating an organization's security controls and practices to ensure they align with policies, standards, and regulations, and to identify areas for improvement.