Which of the following processes evaluates the adherence of an organization to its stated security policy?

A vulnerability assessment identifies technical weaknesses in systems and infrastructure but does not measure adherence to organizational security policy.

Penetration testing simulates adversarial attacks to identify and exploit vulnerabilities, not to evaluate compliance with internal security policies.

A risk assessment identifies, analyzes, and prioritizes potential threats and their business impact, rather than evaluating whether stated policies are being followed.

A security audit systematically examines an organization's security controls, configurations, and operational procedures against its stated policies, regulations, or standards to determine conformance or non-conformance. Unlike vulnerability assessments or penetration tests, the primary focus of an audit is measuring policy adherence rather than discovering exploitable weaknesses. Audit results produce documented evidence of compliance status and identify gaps between policy requirements and actual practice.