The implications of cloud computing on the auditing process

Abstract

Purpose: The purpose of this study is to bring more awareness regarding the topic of cloud computing in the auditing world. Thus, the objectives were to identify the implications of the benefits, risks, and the underlying regulations on the auditing process and how it would need to adapt accordingly. Consequently, another objective was to identify whether there is the need for more cloud expertise and guidance locally. Design: To achieve the objectives of this study, a qualitative research method was adopted. Semi-structured interviews were held with seven IT Auditors. Findings: The findings indicate that there are several benefits and risks that arise due to the cloud, however, it significantly depends on the audit clients and cloud service provider (CSP) governance. If both show good governance and have proper internal controls the impact on the audit process would be minimal and varies accordingly to the cloud deployment model and services being used. However, it was found that small, medium enterprises (SMEs) have less formal controls than larger organisations due to the (1) lack of awareness of the need of having controls and (2) lack of resources. Moreover, it is not clear whether as of currently cloud specialists are necessary, especially in Malta, being that most firms are SMEs, using less complex cloud systems such as software as a service (SAAS). Lastly, the findings show that although there is sufficient guidance on how to audit the cloud, regulatory intervention through monitoring on client organisations and on audit firms is lacking, which could ultimately be the solution in (1) achieving more formal controls and (2) ensuring that best practices are abided by throughout. Conclusion: This study concludes that due to the significant role that cloud computing is taking in Maltese firms, and the complexities thereof, there needs to be more formal controls and regulatory intervention. In addition, continuous professional development is necessary, especially due to the implications of the cloud. Value of the study: This study brings value by bringing more awareness on the benefits and risks faced throughout audits as well as providing suggestions on how governance by organisations can be improved. In addition, it brought to light recommendations on how IT Auditors can upskill and how regulatory bodies in Malta can take a bigger role.