Question 1126 - CISA discussion

The best action that audit management should consider first is to reassign the audit to an internal audit subject matter expert. This is because cloud service audits require specialized knowledge and skills to assess the risks and controls associated with the cloud service provider and the cloud service customer. An IS auditor who is unfamiliar with the technologies in use and their associated risks to the business may not be able to perform an effective and efficient audit, and may miss important issues or provide inaccurate recommendations. Therefore, it is important to ensure that the IS auditor assigned to the cloud service audit has the appropriate competence and experience.

The other options are not as good as reassigning the audit to an internal audit subject matter expert. Conducting a follow-up audit after a suitable period has elapsed may not address the quality issues of the initial audit, and may also delay the identification and remediation of any problems. Rescheduling the audit assignment for the next financial year may expose the organization to unnecessary risks and may not meet the audit objectives or expectations. Extending the duration of the audit to give the auditor more time may not be feasible or cost-effective, and may not guarantee that the auditor will acquire the necessary knowledge and skills in time.

ISACA, CISA Review Manual, 27th Edition, 2019, p.1391

ISACA, Cloud Computing: Business Benefits With Security, Governance and Assurance Perspectives, 2009, p.14