Why do some companies require an information security audit?

Companies require an information security audit to ensure the security is adequate. Also, the audit allows the company to decide if money is being spent properly on security.