According to the definition of audit scope, it is the extent and boundaries of an audit, which include the audit objectives, the activities and documents covered, the time period and locations audited, and the related activities not audited1 Audit scope determines how deeply an audit is performed and may vary depending on the type of audit. Audit scope can also mean the examination of a person or the inspection of the books, records, or accounts of a person for tax purposes1
The most important audit scope document when conducting a review of a cloud service provider is the processes and systems to be audited. This document defines the specific areas and aspects of the cloud service provider that will be subject to the audit, such as the cloud service delivery model, the cloud deployment model, the cloud security domains, the cloud service level agreements, the cloud governance framework, etc2 The processes and systems to be audited document also helps to identify the risks, controls, criteria, and objectives of the audit, as well as the roles and responsibilities of the auditors and the auditees3 The processes and systems to be audited document is essential for planning and performing an effective and efficient audit of a cloud service provider.
The other options are not correct because:
Option B is not correct because the updated audit work program is not an audit scope document, but rather an audit planning document. The audit work program is a set of detailed instructions or procedures that guide the auditor in conducting the audit activities4 The audit work program is based on the audit scope, but it does not define it. The audit work program may also change during the course of the audit, depending on the findings and issues encountered by the auditor4
Option C is not correct because the documentation criteria for the audit evidence is not an audit scope document, but rather an audit quality document. The documentation criteria for the audit evidence is a set of standards or guidelines that specify what constitutes sufficient and appropriate evidence to support the auditor’s conclusions and opinions5 The documentation criteria for the audit evidence is derived from the audit scope, but it does not determine it. The documentation criteria for the audit evidence may also vary depending on the nature and source of the evidence collected by the auditor5
Option D is not correct because the testing procedure to be performed is not an audit scope document, but rather an audit execution document. The testing procedure to be performed is a set of steps or actions that describe how to test or verify a specific control or process within the cloud service provider6 The testing procedure to be performed is aligned with the audit scope, but it does not establish it. The testing procedure to be performed may also differ depending on the type and level of testing required by the auditor6
References: 1: AUDIT SCOPE DEFINITION - VentureLine 2: Audit Scope and Criteria - Auditor Training Online 3: Open Certification Framework | CSA - Cloud Security Alliance 4: Audit Work Program Definition - Audit Work Program Example 5: INTERNATIONAL STANDARD ON AUDITING 230 AUDIT DOCUMENTATION CONTENTS - IFAC 6: What are Testing Procedures? - Definition from Techopedia
