The Shared Responsibility Model
The most important concept for auditing cloud environments is the shared responsibility model — the division of security and control responsibilities between the cloud service provider and the customer organisation. Understanding where this division falls determines what the internal auditor should be testing and what they can rely on the provider's own controls to address.
In an Infrastructure as a Service (IaaS) environment, the provider is responsible for the physical infrastructure, the hypervisor, and the network — but the customer is responsible for the operating system, applications, and data. In Platform as a Service (PaaS), the provider takes on additional layers including the OS and runtime environment, with the customer responsible for applications and data. In Software as a Service (SaaS), the provider manages nearly the entire stack, with the customer primarily responsible for access management and data governance.
The practical implication for internal audit is that IaaS environments require extensive customer-side controls that are very similar to on-premise IT general controls, while SaaS environments shift most technical control responsibility to the provider — with the customer's primary audit focus being access management, configuration security, and vendor risk management.
Key Risk Areas in Cloud Environments
Identity and Access Management: In cloud environments, identity is effectively the new perimeter. Access to cloud resources is controlled through Identity and Access Management (IAM) systems — and misconfigured IAM permissions are one of the leading causes of cloud security incidents. Audit procedures should examine whether the principle of least privilege is applied in IAM configurations, whether privileged access is appropriately controlled and monitored, whether multi-factor authentication is required for sensitive access, and whether access reviews are conducted regularly.
Configuration Security: Cloud resources that are misconfigured — storage buckets that are inadvertently publicly accessible, security groups with overly permissive inbound rules, encryption disabled on sensitive data stores — represent significant security risks. Cloud Security Posture Management (CSPM) tools automate the detection of common configuration errors and provide the audit team with visibility into the current security posture of the cloud environment.
Data Governance: Where is organisational data stored, who can access it, and how is it protected? In cloud environments, data can reside in multiple locations across multiple regions, often across different cloud providers. Data classification and governance processes that were adequate for on-premise environments often need significant extension to address cloud complexity.
Vendor and Third-Party Risk: Cloud service providers are major technology vendors with significant influence over the organisation's IT environment and data. Assurance over cloud providers' own control environments is typically obtained through SOC reports — specifically SOC 2 Type II reports, which provide independent assurance over the security, availability, processing integrity, confidentiality, and privacy of the provider's systems. Audit procedures should verify that appropriate SOC reports are obtained and reviewed for all significant cloud providers.
The most important shift in cloud audit is from testing controls to assessing configuration. Many traditional IT controls — patch management, physical security, infrastructure monitoring — are now the provider's responsibility. The auditor's focus shifts to whether the organisation is correctly configuring and using the provider's control capabilities.
Building a Cloud Audit Programme
Organisations that are early in their cloud audit capability development should start by mapping the cloud services in use across the organisation — many organisations have significant cloud adoption that IT governance has not fully catalogued. For each significant cloud service, assess the applicable shared responsibility model, identify the key risk areas, and determine what combination of customer-side controls, provider-provided controls, and independent assurance (SOC reports) addresses each risk area. Build the audit programme iteratively — starting with the highest-risk, highest-use services and expanding coverage as capability develops.