A security survey or audit is a systematic examination to determine the adequacy and effectiveness of a security program. For the findings to be meaningful, factual, and objective, they must be measured against a recognized benchmark. An "acceptable security standard" serves as this objective criterion. This standard could be an international one (e.g., ISO), an industry-specific best practice, a regulatory requirement, or a well-defined internal corporate policy. This comparison of the current state ("what is") against the standard ("what should be") is the fundamental principle of auditing and ensures the results are consistent, verifiable, and unbiased.

B. previous audit results: Comparing to previous results is useful for tracking progress or regression but does not measure current compliance against an objective, authoritative benchmark.

C. the security professional's knowledge: While essential for conducting the audit, a professional's knowledge is subjective and cannot serve as the formal, objective standard for measurement.

D. past practice: "The way it has always been done" is not a valid benchmark, as past practices may be outdated, non-compliant, or inherently insecure.

1. Fischer

R. J.

Halibozek

E.

& Walters

D. C. (2019). Introduction to Security (10th ed.). Butterworth-Heinemann. In Chapter 10

"Security Surveys and Audits

" the text explains that a survey is a "fact-finding mission" that compares existing conditions against established standards or requirements (p. 215).

2. ASIS International. (2019). Protection of Assets (POA). In the "Security Management" volume

the chapter on "Measuring Security Program Effectiveness" states that audits and assessments are formal processes that compare performance against established criteria

such as standards

policies

and procedures.

3. ASIS International. (2012). Management System for the Quality of Private Security Company Operations—Requirements with Guidance. ASIS/ANSI PSC.1-2012. Section 3.1 defines an audit as a "systematic

independent and documented process for obtaining audit evidence and evaluating it objectively to determine the extent to which the audit criteria are fulfilled." The audit criteria are derived from standards and policies.