Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.
Is there a standard checklist to audit an organization's website security?
There is the OWASP checklist here: OWASP Testing Checklist
Recently some people have collaborated on a checklist for developers: A practical security guide for web developers
I found the second one to be more useful myself, although the OWASP list has been around for much longer.