Three weeks before a payment processor's annual audit, the compliance manager asks the server team for proof that every administrator who left the company last year lost access within one business day. The team is sure it did. The auditor will not accept "we're sure"; she will want tickets, timestamps and account logs, and she will pick which ones to look at.
That gap between believing a control works and proving it is what audits and assessments close. On the CompTIA Security+ SY0-801 exam this sits under objective 5.5, which expects you to explain how organizations check their security through audits and assessments. This lesson covers how evidence is gathered, how an audit is scoped, and the engagement types you need to tell apart: internal, external, gap analysis and benchmarking. Penetration testing and the threat frameworks also used as reference sources have their own lessons in this section.
Audits judge against criteria, assessments measure and advise
The two words are often used loosely, but the difference matters on the exam.
An audit is a formal, evidence-based evaluation of whether an organization meets a defined set of criteria: a regulation, a standard such as PCI DSS or ISO/IEC 27001, a contract, or the organization's own policies. The auditor must be independent of the work being audited, follows a documented method, and produces a report with findings, often with a formal opinion or a pass-or-fail result.
An assessment is a broader term for evaluating security posture. It can be formal or informal, performed by insiders or outsiders, and its purpose is usually to measure and improve rather than to certify. A risk assessment, a maturity assessment against a framework and a vendor security assessment are all assessments. Their output is typically a list of observations and recommendations, not an opinion that a third party relies on.
A useful test: if someone outside the organization, such as a regulator, a customer or a card brand, will rely on the result, it is probably an audit or an examination. If the result is mainly for the organization's own improvement, it is usually an assessment.
Auditors gather evidence in a handful of standard ways
Every audit and assessment runs on evidence, and objective 5.5 names the main ways to collect it.
Sampling means testing a subset of a population and drawing a conclusion about the whole. If 340 employees left the company last year, an auditor might select 25 terminations and check each one against the HR system, the deprovisioning ticket and the directory's account-disabled timestamp. A statistical sample is chosen randomly so the result can be extended to the population with known confidence. A judgmental sample is chosen by the auditor's experience, for example picking every privileged account plus a handful of ordinary ones. In common practice, sample size grows with how often a control runs: an annual control might be tested once, while a control that runs many times a day needs a much larger sample.
Questionnaires and surveys collect structured answers from many people at once. They scale well, which is why they are used for control self-assessments and vendor reviews, but the answers are self-reported. A questionnaire that says "yes, all laptops are encrypted" is a lead to verify, not proof.
Interviews are conversations with control owners and staff. An auditor asks the backup administrator to walk through how restores are tested, then asks to see the last restore test record. Interviews reveal how a process actually runs, including the steps nobody wrote down, but like questionnaires they need corroboration.
An assertion is a claim made by management that the auditor then tests. In an attestation engagement, management states in writing something like "the controls described were suitably designed and operated effectively from January 1 to December 31." The auditor's job is to gather enough evidence to support or contradict that statement. On the exam, the assertion is the claim; evidence is what proves or disproves it.
Reference sources are the external bodies of knowledge an assessor works from: standards and regulations that define the criteria, and frameworks that describe how attackers behave. MITRE ATT&CK, the Cyber Kill Chain and the Diamond Model are named in the objective as reference sources and are covered in the threat frameworks lesson.
Auditors trust some evidence more than others. An answer given in an interview is the weakest, because it is only a claim. Watching someone perform a task is stronger, inspecting system records is stronger again, and reperforming the control yourself, such as disabling a test account and confirming access is gone, is strongest. A finding built only on what people said rarely survives review.