Question

1. Discuss the risks, benefits, and audit issues related to cloud computing.

2. What is the role of internal audit for enterprise-wide risk management?

Answer 1

QUESTION 1

Risks related to cloud computing

• Evaluate Virtualization risks • Evaluate SaaS risks • Evaluate PaaS risks • Evaluate IaaS risks • Understand public cloud risks • Understand private cloud risks • Understand hybrid cloud risks • Evaluate cloud consumer risks • Evaluate cloud provider risks • Perform an analysis of the security risks

Benefits related to cloud computing

Highly scalable , low cost , affordable, great interface to users , easy accessibility, wide range of services to offer, secure etc.

Audit Issues related to cloud computing

Identify the risk of cloud computing operations.

Identify the risk audit of cloud computing operations.

Identify the audit standards of cloud computing operations.

Integrating the risk and audit process of cloud computing practice.

QUESTION 2.

The role of internal auditing in enterprise-wide risk management is an independent, objective assurance and consulting activity. Its core role with regard to enterprise-wide risk management is to provide objective assurance to the board on the effectiveness of risk management. Indeed, research has shown that board directors and internal auditors agree that the two most important ways that internal auditing provides value to the organization are in providing objective assurance that the major business risks are being managed appropriately and providing assurance that the risk management and internal control framework is operating effectively.

Enterprise-wide risk management activities and indicates which roles an effective professional internal audit activity should and, equally importantly, should not undertake. The key factors to take into account when determining internal auditing’s role are whether the activity raises any threats to the internal audit activity’s independence and objectivity and whether it is likely to improve the organization’s risk management, control and governance processes.