Skip to content

CS Professional · Internal and Forensic Audit · Emerging Issues and Challenges

Mahalaxmi Retail Ltd shifts its inventory and billing systems to a third-party cloud provider. In planning the internal audit, which approach best addresses the new risk?

The auditor should extend scope to the cloud arrangement by reviewing the provider's independent assurance reports, contractual terms on data security and access, and the company's own user access controls. Outsourcing hosting does not transfer the company's accountability for its data and controls.

  1. AAssume the provider is fully responsible, so no audit scope is needed
  2. BLimit the audit to the company's own office computers
  3. CInclude review of the provider's assurance reports, contract terms on data security and access, and the company's own user access controlsCorrect
  4. DAsk the provider to appoint the company's internal auditor

Explanation

Outsourcing the hosting does not transfer accountability for data and controls. The auditor should consider the provider's independent assurance reports, contractual security and access terms, and the company's own user controls. Ignoring the cloud or letting the provider choose the auditor undermines independence and coverage.

Did you get it right without looking?

One question tells you little. A timed set on Emerging Issues and Challenges shows your real accuracy, how long you take and where you lose marks.

Practise Emerging Issues and ChallengesFree diagnostic mock

More Emerging Issues and Challenges questions