A cloud service provider utilizes services of other service providers for its cloud service. Which of the following is the BEST approach for the…

According to the ISACA Cloud Auditing Knowledge Certificate Study Guide, the auditor should review

the relationship between the cloud service provider and its service provider to help direct and

estimate the level of effort and analysis the auditor should apply1. The auditor should understand

the nature and scope of the services provided by the service provider, the contractual obligations and

service level agreements, the security and compliance requirements, and the monitoring and

reporting mechanisms. The auditor should also assess the risks and controls associated with the

service provider, and determine if additional audit procedures are needed to obtain sufficient

assurance.

The other options are not the best approach for the auditor. Option A is too strict and might not be

feasible or necessary, depending on the type and level of services provided by the service provider.

Option C is too lax and might overlook significant risks and gaps in the cloud service. Option D is too

narrow and might ignore the impact of the service provider on the cloud customer’s business

context. Reference:

ISACA Cloud Auditing Knowledge Certificate Study Guide, page 13-14.