Before You Take Internal Audit To The Cloud
Moving to the cloud was one of the trending ideas last year and still is, however, it presents a number of risk factors that are completely manageable with a little preparation.
Achieving this in a comprehensive and effective way is quiet gradual and you don't have to start from scratch.
Cloud computing is transforming the way in which businesses consume and deliver IT services within their organizations. By making computing resources, including computing power and data storage, available on-demand without the user’s direct oversight or management, cloud computing has empowered organizations and their employees with the flexibility to work anywhere, at any time, in real-time.
Apply these principles and you will be good to go!
Here is how………………
For cloud computing, whether provided to organizations via Infrastructure as a Service (IaaS), Platform as a Service (PaaS) or Software as a Service (SaaS) presents an array of risk factors for organizations. Internal audit has an essential role to play in helping management and the board identify, consider, and manage these risks, and in determining whether they are being adequately mitigated.
See the following risks and internal audit’s role in addressing them.
Issues and Risks
Organizations face a number of risks in using the cloud, including but not limited to:
Regulatory compliance:
- The risk that organizations subject to regulatory oversight will be found non-compliant (e.g. requirements for the use and protection of personal data).
IT bypass
- The unaddressed or unmitigated risks resulting from departments setting up their own technology environments via the cloud and sidestepping the organization’s IT protocols and controls.
The loss, theft or corruption of sensitive data:
- The risk of severe reputational damage and possible criminal prosecution or civil action as a result of the loss of sensitive data.
User access:
- The risk that cloud providers will fail to adequately restrict data access.
Data location and ownership:
- Depending on where data that is “in the cloud” is actually stored, the risk of failing to meet the requirements of that jurisdiction or of failing to meet customer or contract requirements restricting data storage to certain jurisdictions.
The Role of Internal Audit
Internal audit is in an excellent position to help management and the audit committee/board manage and mitigate these and other risks.
Four key areas of focus include the following:
1. Creating a Cloud Strategy
Internal audit should work with management to determine whether a strategy for the cloud is in place, aligned with the needs of the business and its IT strategy, and well-communicated. Among the questions that should be asked:
- Has a business case been built for moving to the cloud?
- Is it consistent with planned investments in application infrastructure?
- Can the risks associated with cloud migration be adequately mitigated or accepted
- Would a move to the cloud enable the business to grow or scale more cost-efficiently?
- What data, exactly, will be moved to the cloud?
- Is critical data involved?
2. Vendor Evaluation
Internal audit can also play a key role in determining how well vendors are addressing risk and control.
- Have cloud vendors adequately described the data security controls they will use?
- Does the cloud vendor provide detailed descriptions of their security systems, including physical security and user access and authentication protocols?
- Security policies, vulnerability, and penetration test results, and attestations on internal control environments should all be requested. Does the vendor have independent assessments of their control environment such as SSAE 16 or ISAE 3402 reports?
- Are the vendor’s business continuity and disaster recovery plans adequate and aligned with the organization’s needs?
3. Implementation of a Cloud Computing Model
- Internal audit should assess the migration process and mitigating project risk.
- Does the implementation align with the organization’s system development approach as well as with project management and change management methodologies?
- Has the effectiveness of mitigating controls and strategies been assessed before implementation?
- Service-level (SLAs) and operating level agreements (OLAs) have particular importance in regard to cloud computing. These provide objective measures of performance that can be directly linked with business risk. What about the provider’s responsibilities in regard to regulatory, legal and data protection and other requirements? Has a process been defined for identifying and reporting issues, including data breaches, data back-ups, and user access?
4. Vendor Monitoring
- Internal Audit should also assess how well the vendor relationship is being monitored and controlled relative to SLAs and OLAs, and also whether issues, as they arise, are being adequately investigated and resolved.
- Vendor internal control assessments, including SSAE 16s, penetration tests and vulnerability scans, should be routinely reviewed.
- Is the cloud vendor adequately addressing regulatory requirements?
"The Future is Cloud if we manage the Risk"
Cloud computing is a form of IT outsourcing, of course. Just like any other outsourced service, the rules governing its provision (in the form of SLAs and OLAs) must be carefully defined, managed and monitored. Further, the effectiveness of any contract depends on defining where the responsibilities lie and who bears the risk. Cloud computing is no exception. Internal Audit can make a vital contribution in identifying and evaluating the risks attending these relationships, including in the areas of performance level, business continuity, and data protection.
Acknowledgment to CASEWARE
Acknowledgment to CASEWARE
