An auditor examines an organization to determine if they appear to be compliant with a particular standard or regulation. They make their findings based on evidence, often directly supplied by the organization upon request of the auditor. And they are generally independent from the organizations they audit.
In the case of a security audit, the auditor may look for evidence that the organization has a security policy, that the policy is adequate to protect them according to the standard, and that the organization follows it. That policy will state practices to be followed, such as requiring code reviews. An auditor likely won't do a code review himself, but he might look for a documentation trail that demonstrates the organization does do code reviews. The standard may also require annual penetration tests, and he will examine documents produced by the penetration testers. He might also check with the pen testing company to be sure the organization wasn't lying about having pen tests. If he doesn't see such documentation trails, he finds that the organization is out of compliance.
An auditor can't verify that an organization is secure. He can only find that an organization appears to be trying to operate in a secure manner.