A third-party audit involves an external auditor reviewing a company's compliance with security policies, procedures, and standards. This type of audit is used to provide an objective assessment of an organization’s security practices, usually against established frameworks or regulatory requirements. Unlike an internal audit, it is performed by independent auditors not affiliated with the organization being audited, offering an outside perspective on the effectiveness of its security measures. An internal audit, on the other hand, is conducted by the organization's own staff, and self-assessments are informal evaluations typically carried out by staff to check their own compliance with procedures. Vendor assessments usually focus on assessing the risks associated with a specific third-party service provider or supplier.