Enron and WorldCom financial scandals raised concerns by government
about accounting errors and fraudulent practices created within
organizations. The Sarbanes–Oxley Act (SOX) of 2002 was legislated
to require CEOs and CFOs in publicly traded U.S. organizations to
personally certify and be responsible for their company’s financial
statements. Since SOX commands the storage times for specific financial
records, it thus requires IT departments to maintain such electronic
records. SOX stipulate that all business records and e-messages must
be saved for not less than five years. For this reason, organizations
using IT for financial processes must conduct IT controls to comply
with SOX legislation. IT auditing thus becomes a mainstream in auditing
practices.
The coverage of IT auditing is broad since public organizations adopt
information technology for processing their business data. No matter
what business models (either regular business or electronic business)
they adopt, all financial data and messages would be handled by ICT
(information and communication technology) systems. In order to
pursue SOX compliance, a secured and risk-free IT control is mandated.
Therefore, a complete IT auditing should examine a company’s internal
information systems and their inputs, outputs, and processing
components. Other supplementary examination should include IT
department’s hardware, software, communication networks, interfaces,
etc. Another goal of IT auditing is to identify and monitor various risks
that may reside in the IT operational processes.
A newly developed computing area—cloud computing—has been
adopted by a number of organizations for various purposes. Organizations
move to cloud computing practice may gain possible benefits such as cost
saving, efficiency improving, agility enhancing, flexibility and scalability
expansions, and environmental sustainability. Cloud computing is gaining
popularity since it changes the IT industry by sharing resources through
the idea of virtualization. In the meantime, one major concern to cloud
computing is its virtualized environment. The operation of cloud computing
is similar to the practice of information systems outsourcing. The
similarity between the two is the use of external vendor’s hardware,
software, infrastructure, or storage capabilities for internal ICT processes.
The purpose of this paper is to discover the challenges faced by cloud
computing audit. Since cloud computing may become the next wave of
IT innovation, organizations may adopt this technology for major
business processes. Therefore, a clear examination of cloud computing
audits may contribute to the field by providing auditors a vibrant
practical guidance. The structure of this paper is as follows: the next
section discusses the rise of cloud computing. It then provides a detailed
discussion to IT auditing and some IT auditing methods in the next two
sections. After that, the process of cloud computing auditing is
discussed. Guidelines about cloud computing audit then follow. The
next section points out standards, challenges, and future of cloud
computing auditing. A conclusion to this paper is presented in the last
section.