This article discusses information security audit methods necessary to ensure confidentiality, integrity, accessibility and authenticity of information, as well as to monitor compliance with obligations. The author identifies three main audit methods: active audit, expert audit and compliance audit. Active audits examine the level of security of an information system from the point of view of an attacker, which allows you to identify vulnerabilities and develop methods to eliminate them. Expert audits are based on comparing the state of information security with the requirements of the companyʼs management and international experience, and the method of interviewing company employees is used to collect information. Compliance audits assess the compliance of information systems with various security standards. The author analyzes the pros and cons of each method and highlights the areas of application. The main idea of the article is that an information security audit can help identify vulnerabilities and risks, which in turn will help to increase the level of protection of information and business processes of the company.