(If your organization is required to follow one or more compliance frameworks, you’ll likely be required to have a third party perform an audit to verify that your company consistently meets compliance standards.

When an organization undergoes an audit, it must provide audit evidence, also called audit documentation. This could include financial statements, internal documents, policies, procedures, logs, and emails. The auditor uses that evidence to assess how well the client organization is adhering to internal controls, following processes, and fulfilling requirements.

Audit evidence is collected through audit procedures. The evidence might either support the organization’s claim of achieving compliance or disprove that claim.

Internal audits are valuable for identifying issues before an external audit (when discovery of an issue will likely raise more red flags and cost more to fix). Compliance frameworks often require internal audits for ongoing monitoring. External audits are performed by independent, third-party audit firms.)