An audit function is an independent review role that examines whether controls are designed well, operated consistently, and backed by evidence. In cyber security, that means checking things like access reviews, logging, patching, backup testing, incident response records, and policy exceptions. Independence matters: auditors should not own the systems they assess, so they can verify controls without conflict of interest.
The audit function matters because many attacks succeed where controls are weak, inconsistent, or undocumented. A good audit review can expose missing evidence, excessive privileges, untested recovery plans, or gaps between policy and practice. In defense, it helps organizations detect control drift, prioritize remediation, and prove to regulators, customers, and insurers that risk handling is real, not just written down. In connected environments, audit also helps combine evidence from operations, finance, legal, and security into one view of exposure.