Comment by aviditas

In my opinion, most audits for security are the same as having an accountability buddy. The company goes I'm doing x, y, and z then the auditor collects and organizes the proof for or against those assertions. Like a good project manager, a good auditor doesn't have to be a domain expert. Security professionals tend to have strong opinions on what the right way to do a thing is, so an auditor with years of security experience can be a toss up whether it will be a help or hindrance. There are security consultants that provide significant value in reviewing and providing recommendations, but they can be difficult to find among the chaff. And even if the company hires an amazing consultant or security service, the company still has to adopt and implement. Information security at organizations is highly dependent on the executives and how they view security measures.