Top considerations in Internal audit in the Cloud Computing environment

Posted by | September 27, 2018 | Latest Audit Information & News

Top considerations in Internal audit in the Cloud Computing environment

Cloud computing is the provision of hardware and software services by a third party company accessed over the internet. A survey in 2014 by the Cloud Industry Forum (CIF) based in the UK has shown that 78% of organizations have adopted one or more cloud services representing growth of 61.5% since 2010 when their annual study first began. Furthermore, the study found that large enterprises showed the highest rates of cloud adoption (80%), while small and medium businesses stood at 75% with the public sector at roughly 68%.

Cloud computing technology is deployed in four general types, based on the level of internal or external ownership and technical architectures:

Public Cloud: services from vendors that can be accessed across the Internet or a private network

Private Cloud: Built, managed and used internally by an enterprise

Hybrid Cloud: Mix of vendor Cloud services, internal Cloud computing architectures, and classic IT infrastructure

Community Cloud: Infrastructure is shared by several organizations and supports a specific community that has shared concerns

Cloud computing services are grouped into specific categories: Infrastructure, Platform and Software services.

Internal audit consideration will be required for the following in Cloud Computing:

Data Security : Ask the Cloud Service Provider (CSP) whether it receives a Service Organization Controls (SOC) 2 report, which is a third-party attestation report regarding the CSP’s controls relating to security, availability, processing integrity, confidentiality or privacy.  Verify that the scope of the SOC 2 report adequately covers the cloud services provided to your company, data security controls and that the auditor’s opinion is unqualified

Regulatory Compliance: Determine where the company’s data will be stored and the form of the data (e.g., production, backup, cache)

Availability: Verify that your company’s contract with the CSP includes provisions relating to system availability

Business Continuity and Disaster Recovery Planning: Verify that your company’s business continuity and disaster recovery plans are updated to incorporate the risks relating to the outsourcing of IT services to the CSP and that there are adequate plans in place to mitigate these risks

Return on Investment: Understand and review your company’s business case for moving to the cloud.  Verify that your company has clearly documented the cost and benefits and that it is tracking these to verify that they are realized.

Audit International are specialists in the recruitment of Internal Auditors and Corporate Governance Professionals across Europe and the US.

If you would like to reach out to discuss your current requirements, please feel free to reach us on 0041 4350 830 95.

906 total views, 1 today