 Finally the auditor should attain verification from management that the encryption system is strong, not attackable and compliant with all local and international laws and regulations.The first step in an audit of any system is to seek to understand its components and its structure.When auditing logical security the auditor should investigate what security controls are in place, and how they work.