TFL Vsebine / Revija SIR*IUS

Internal auditing of cloud services

Globalni trendi kažejo na vedno večji obseg uporabe storitev v oblaku, kar organizacijam pomaga pri obvladovanju tveganj upravljanja informacijske podpore predvsem z vidika obvladovanja informacijske infrastrukture. Se pa pri uporabi krepijo druga tveganja, povezana predvsem z zanesljivostjo delovanja storitev v oblaku (zanesljivost ponudnika) in posameznimi vidiki skladnosti s predpisi. Notranja revizija mora presoditi vpliv teh tveganj na doseganje ciljev organizacije in jih – če ugotovi, da gre za ključna tveganja – vključiti v načrt dela notranje revizije. V prispevku so predstavljene osnovne značilnosti storitev v oblaku ter z njimi povezana tveganja tako z vidika uporabe kot tudi zagotavljanja storitev v oblaku. Za oba vidika so v prispevku pripravljena izhodiščna temeljna revizijska vprašanja, ki jih notranji revizor lahko uporabi pri načrtovanju obsega in pripravi delovnega programa notranjerevizijskega posla. Podani so tudi primeri gradiv za podrobnejša sodila v okviru mednarodno uveljavljenih standardov in dobrih praks.

Global trends indicate an increasing use of cloud services, which helps organizations manage the risks associated with IT support, particularly in terms of managing IT infrastructure. However, the use of cloud services also amplifies other risks, primarily related to the reliability of cloud services (provider reliability) and various aspects of regulatory compliance. Internal audit must assess the impact of these risks on the achievement of organizational goals and incorporate them into the internal audit activity’s plan if perceived significant. The article presents the basic characteristics of cloud services and the associated risks, both from the perspective of the use and provision of cloud services. For both perspectives, the article provides fundamental audit questions that internal auditors can use when planning the internal audit scope and preparing the internal audit work program. Examples of sources for detailed criteria within the frameworks of internationally recognized standards and best practices are also provided.