Which of the following processes evaluates the adherence of an organization to its stated security policy?

Vulnerability assessment identifies and classifies technical weaknesses in systems, not whether the organization follows its own policy.

Penetration testing simulates real-world attacks to exploit vulnerabilities, which is not the same as measuring policy adherence.

Risk assessment evaluates potential threats and their impact on assets, not whether the organization is following its defined security policy.

Security auditing is specifically defined as a systematic evaluation that compares an organization's actual practices against its stated security policies, standards, and procedures. Unlike other assessment types, its primary purpose is policy adherence verification rather than threat identification or exploitation. Audits produce documented evidence of compliance or non-compliance with internal and regulatory requirements.