Which of the following processes evaluates the adherence of an organization to its stated security policy?

A vulnerability assessment identifies and quantifies technical security weaknesses in systems and software, not whether the organization follows its security policy.

Penetration testing simulates real-world attacks to test the effectiveness of security controls, not to evaluate adherence to internal policy.

A risk assessment identifies, analyzes, and prioritizes potential threats and their impacts, not whether the organization is following its stated policies.

A security audit specifically evaluates an organization's compliance with its own stated security policies, procedures, and standards by comparing actual practices against documented requirements. Auditors systematically review controls, configurations, and behaviors to identify gaps and non-compliance. This distinguishes auditing from assessments that focus on technical weaknesses or risk levels rather than policy adherence.