Due to cloud audit team resource constraints, an audit plan as initially approved cannot be completed. Assuming that the situation is communicated in the cloud audit report which course of action is…

The correct answer is A. Focusing on auditing high-risk areas. When audit resources are insufficient to complete the full audit plan, the professional standard response is risk-based prioritization: concentrate limited resources on the areas that pose the greatest risk to the organization. This approach maximizes audit value per resource…

Cloud Auditing Basics and Tools

Question

Due to cloud audit team resource constraints, an audit plan as initially approved cannot be completed. Assuming that the situation is communicated in the cloud audit report which course of action is MOST relevant?

Options

AFocusing on auditing high-risk areas
BTesting the adequacy of cloud controls design
CRelying on management testing of cloud controls
DTesting the operational effectiveness of cloud controls

How the community answered

(43 responses)

A
72% (31)
B
5% (2)
C
7% (3)
D
16% (7)

Explanation

When audit resources are insufficient to complete the full audit plan, the professional standard response is risk-based prioritization: concentrate limited resources on the areas that pose the greatest risk to the organization. This approach maximizes audit value per resource consumed and ensures that the most critical vulnerabilities or control gaps are identified. Relying on management testing (C) would compromise auditor independence. Testing control design adequacy (B) or operational effectiveness (D) are audit activities that apply regardless of scope - they do not address how to triage when resources run short. The IIA and ISACA both direct auditors to apply risk-based approaches when scope must be reduced.

Topics

#Cloud audit planning#Resource constraints#Risk-based auditing#Audit prioritization

Community Discussion

No community discussion yet for this question.

Full CCAK Practice