Insights · Question
What is the difference between an audit and an assessment?
An audit tests whether an organization conforms to a defined standard or set of criteria and produces a formal result: a certificate, an attestation report or a pass and fail against each requirement, performed by a body authorized to issue it. An assessment examines a posture, program, system or risk against good practice and the organization’s own objectives, and produces graded findings, evidence and recommendations without a formal opinion. Audits answer whether you meet the standard; assessments answer how exposed you are and what to do. Readiness work is assessment performed so that the audit confirms rather than discovers.
In more detail
The reasoning.
ISO/IEC 27001 certification and SOC 2 are audits, performed by accredited certification bodies and licensed CPA firms respectively. CMMC Level 2 certification is an assessment in name but an audit in character, performed by an authorized assessor against defined requirements. A security posture review, a gap assessment, a vendor assessment or a penetration test are assessments.
Both need evidence, and both are only as good as the examiner’s independence. An assessment that finds everything satisfactory is as suspicious as an audit that samples nothing.
See Compliance and Audit Readiness, security posture reviews and the glossary entries for audit readiness and gap assessment.
By David Selakovic · Published 2026-10-16 · Revised 2026-10-16 · Reviewed every 90 days