What describes the goal of security audits?

• A. To punish staff for errors
• B. Systematic reviews of policies, controls, and procedures to identify gaps and improve security posture
• C. Minimize investment in security
• D. Replace security teams

Answer: (B)

At its heart, a security audit is a structured, objective examination of an organization's security framework—policies, controls, and day-to-day procedures—to identify gaps and weaknesses and plan improvements. This focus on discovering gaps and strengthening defenses explains why it best describes the goal of security audits. Audits are not about punishing staff, cutting security spending, or replacing security teams; those ideas miss how audits support ongoing risk management and continuous improvement. Instead, the process provides evidence, shows where controls work and where they don’t, and guides prioritization of remediation to raise the overall security posture.