Regarding suppliers of a cloud service provider, it is most important for the auditor to be aware that the client organization has a clear understanding of the provider’s suppliers. This is because cloud services often involve multiple parties in the supply chain, such as cloud providers, sub-providers, brokers, carriers, and auditors. Each party may have different roles and responsibilities in delivering the cloud services and ensuring their quality, security, and compliance. Therefore, it is essential for the client organization to have visibility and assurance of the performance and compliance of the provider’s suppliers and to establish clear and transparent agreements with them regarding their roles, responsibilities, expectations, and obligations.12
An auditor should be aware of the importance of the client organization’s understanding of the provider’s suppliers because it provides a basis for assessing the risks and challenges associated with outsourcing services to a cloud provider and its supply chain. An auditor can use the client organization’s understanding of the provider’s suppliers to verify that the client organization has conducted a thorough due diligence of the provider’s suppliers and their capabilities, qualifications, certifications, and reputation. An auditor can also use the client organization’s understanding of the provider’s suppliers to evaluate whether the client organization has implemented adequate controls and processes to monitor, audit, or verify the security and compliance status of their cloud services and data across the supply chain. An auditor can also use the client organization’s understanding of the provider’s suppliers to identify any gaps or weaknesses in the client organization’s security management program and to provide recommendations for improvement.34
References := Practical Guide to Cloud Service Agreements Version 2.01; HIDDEN INTERDEPENDENCIES BETWEEN INFORMATION AND ORGANIZATIONAL …2; Cloud Computing: The Audit Challenge - ISACA3; Cloud Computing: Audit Considerations - AICPA4
