Audit

Applies to. PCI DSS v4.0.1 does not call its own examination an audit; it calls it an assessment, reported in a Report on Compliance or a Self-Assessment Questionnaire with an Attestation of Compliance. Inside the standard the word appears almost only in 'audit log', the Requirement 10 record of system activity that an assessor examines as evidence; 10.2.1, for example, requires audit logs to be enabled and active on all system components. What people usually mean by a PCI audit is the assessment: an assessor examining documents, configurations and logs and interviewing personnel against each requirement's testing procedures.

Limits. An audit log is not an audit: the log is the evidence, the assessment is the examination of it.