Isaca Updated CCAK Exam Questions and Answers by amanda

According to the ISACA CCAK Study Guide, the auditor should report the findings to the management of the organization being audited, as they are the primary stakeholders and decision makers for the cloud service. The management is responsible for ensuring that the cloud service meets the requirements and expectations of the community, as well as complying with any relevant laws and regulations. The auditor should also communicate the findings to the cloud service provider, as they are the secondary stakeholders and service providers for the cloud service. The cloud service provider should be aware of any issues or gaps identified by the auditor and work with the management to resolve them. The auditor should not report the findings to the public, shareholders, or interested parties, as they are not directly involved in the cloud service or its governance. The auditor should respect the confidentiality and privacy of the community and its data, and only disclose the findings to those who have a legitimate need to know. References :=

• ISACA, Certificate of Cloud Auditing Knowledge (CCAK) Study Guide, 2021, p. 971
• ISACA, Cloud Auditing Knowledge: Preparing for the CCAK Certificate Exam, 2021, p. 36

 Supply chain agreements between a cloud service provider and cloud customers should, at a minimum, include audits, assessments, and independent verification of compliance certifications with agreement terms. This is because cloud services involve multiple parties in the supply chain, such as cloud providers, sub-providers, brokers, carriers, and auditors. Each party may have different roles and responsibilities in delivering the cloud services and ensuring their quality, security, and compliance. Therefore, it is important for the cloud customers to have visibility and assurance of the performance and compliance of the cloud providers and their sub-providers. Audits, assessments, and independent verification of compliance certifications are methods to evaluate the effectiveness of the controls and processes implemented by the cloud providers and their sub-providers to meet the agreement terms. These methods can help the cloud customers to identify any gaps or risks in the supply chain and to take corrective actions if needed. This is part of the Cloud Control Matrix (CCM) domain COM-04: Audit Assurance & Compliance, which states that "The organization should have a policy and procedures to conduct audits and assessments of cloud services and data to verify compliance with applicable regulatory frameworks, contractual obligations, and industry standards."12 References := CCAK Study Guide, Chapter 3: Cloud Compliance Program, page 551; Practical Guide to Cloud Service Agreements Version 2.02

In multi-cloud environments, organizations use cloud services from multiple providers. This can lead to challenges in maintaining visibility and control over the data and services due to the varying management tools, processes, and security controls across different providers. The complexity of managing multiple service models and the reliance on different cloud service providers can reduce an organization’s ability to monitor and control its resources effectively, thus increasing the risk of reduced visibility and control.

References = The information aligns with the principles outlined in the CCAK materials, which emphasize the unique challenges of auditing the cloud, including ensuring the right controls for confidentiality, integrity, and accessibility, and mitigating risks such as those associated with multi-cloud environments12.

According to the definition of audit scope, it is the extent and boundaries of an audit, which include the audit objectives, the activities and documents covered, the time period and locations audited, and the related activities not audited1 Audit scope determines how deeply an audit is performed and may vary depending on the type of audit. Audit scope can also mean the examination of a person or the inspection of the books, records, or accounts of a person for tax purposes1

The most important audit scope document when conducting a review of a cloud service provider is the processes and systems to be audited. This document defines the specific areas and aspects of the cloud service provider that will be subject to the audit, such as the cloud service delivery model, the cloud deployment model, the cloud security domains, the cloud service level agreements, the cloud governance framework, etc2 The processes and systems to be audited document also helps to identify the risks, controls, criteria, and objectives of the audit, as well as the roles and responsibilities of the auditors and the auditees3 The processes and systems to be audited document is essential for planning and performing an effective and efficient audit of a cloud service provider.

The other options are not correct because:

• Option B is not correct because the updated audit work program is not an audit scope document, but rather an audit planning document. The audit work program is a set of detailed instructions or procedures that guide the auditor in conducting the audit activities4 The audit work program is based on the audit scope, but it does not define it. The audit work program may also change during the course of the audit, depending on the findings and issues encountered by the auditor4
• Option C is not correct because the documentation criteria for the audit evidence is not an audit scope document, but rather an audit quality document. The documentation criteria for the audit evidence is a set of standards or guidelines that specify what constitutes sufficient and appropriate evidence to support the auditor’s conclusions and opinions5 The documentation criteria for the audit evidence is derived from the audit scope, but it does not determine it. The documentation criteria for the audit evidence may also vary depending on the nature and source of the evidence collected by the auditor5
• Option D is not correct because the testing procedure to be performed is not an audit scope document, but rather an audit execution document. The testing procedure to be performed is a set of steps or actions that describe how to test or verify a specific control or process within the cloud service provider6 The testing procedure to be performed is aligned with the audit scope, but it does not establish it. The testing procedure to be performed may also differ depending on the type and level of testing required by the auditor6

References: 1: AUDIT SCOPE DEFINITION - VentureLine 2: Audit Scope and Criteria - Auditor Training Online 3: Open Certification Framework | CSA - Cloud Security Alliance 4: Audit Work Program Definition - Audit Work Program Example 5: INTERNATIONAL STANDARD ON AUDITING 230 AUDIT DOCUMENTATION CONTENTS - IFAC 6: What are Testing Procedures? - Definition from Techopedia