To ensure that cloud audit resources deliver the best value to the organization, the PRIMARY step would be to:

Question

Options

• Adevelop a cloud audit plan on the basis of a detailed risk assessment.
• Bschedule the audits and monitor the time spent on each audit.
• Ctrain the cloud audit staff on current technology used in the organization.
• Dmonitor progress of audits and initiate cost control measures.

• A
  80% (32)
• B
  5% (2)
• C
  13% (5)
• D
  3% (1)

Explanation

Audit value is maximized when effort is directed at areas of highest risk. Developing an audit plan grounded in a detailed risk assessment ensures that auditors focus on controls and processes where failures would have the greatest business impact. This is the foundation of risk-based auditing as defined by IIA, ISACA, and ISO 19011. Scheduling audits and monitoring time (B) and monitoring progress with cost controls (D) are project management activities - useful but secondary. Training staff (C) builds capability but is not the primary driver of value allocation. Without a risk-based plan, well-scheduled, well-trained auditors may spend time in low-risk areas while critical exposures go unexamined.

No community discussion yet for this question.