An audit examines a situation against a defined objective
An audit can mean reviewing configuration, organisation or exposure. Specify what will be examined and on what basis. Understanding internet-facing assets through an exposure audit is different from reviewing source code or checking procedures. The service name alone does not define the work.
A penetration test checks exploitability
Penetration testing exercises agreed systems using defined access and rules. It can provide concrete evidence of a weakness and its consequences. It does not automatically cover an entire organisation and is not a general guarantee of security. Findings must be read within the engagement’s scope.
Choose or combine approaches
Start with the decision you need to make: map exposure, test an application or improve practices. An incomplete inventory may justify exposure work before a penetration test. A software issue may call for a code review. Ask what each engagement will demonstrate and what will remain outside its scope.