Information Security Audit

I have been assigned to carry out an information security audit on my users. I am not sure what kind of question I should ask during the audit. May I know is anyone has done the similar or where can I have the sample question for reference?