When it comes to information assurance audit, what the audit is doing is documenting the validity and effectiveness of controls against stated policy that claims to be addressing required security measures. 