Legal, Risk and Compliance · Topic 3 of 6
Cloud Audit Controls and Audit Reports
CCSP cloud audit: internal and external controls, audit requirements, assurance challenges, SSAE 18 SOC 1, 2, 3, ISAE reports and scope limits.
- 5 min
- Includes a diagram
- Internal audit assures management and the board; external audit assures outside parties.
- SOC 1 is financial reporting; SOC 2 is the Trust Services Criteria; SOC 3 is a public summary.
- Type 1 is design at a point in time; Type 2 is operating effectiveness over a period.
What it is
An audit gives independent assurance that controls are designed and working. In the cloud, customers usually cannot audit the provider themselves, so they depend on reports from the provider's auditors. Knowing what each report covers, and what it leaves out, is central to the CCSP.
How it works
Internal and external audit controls
| Audit | Performed by | Purpose |
|---|---|---|
| Internal audit | The organization's own audit function, independent of the areas audited | Assure management and the board that controls work; find issues early |
| External audit | Independent third party | Give assurance to outsiders such as customers, regulators and shareholders |
Internal audit reports to the board or audit committee so it stays independent of management. External audits produce attestations or certifications others can rely on.
Impact of audit requirements
Regulations and contracts may require audits at set frequencies, of set scope, with specific standards. In the cloud this affects provider choice (the provider must be able to supply suitable reports), contract terms (right to audit, access to reports), and design (logging and evidence must exist for the auditor to test). Many providers replace individual customer audits with a shared set of third-party reports because they cannot allow thousands of customers on site.
Assurance challenges of virtualization and cloud
- Dynamic environments: resources change by the minute, so point in time sampling misses much.
- Shared infrastructure: auditors cannot examine hosts that also serve other tenants.
- No physical access: customers rely on the provider's auditors for data center controls.
- Hypervisor visibility: the virtualization layer is controlled by the provider and rarely visible to customers.
- Subservice organizations: the provider may rely on other providers that its report excludes.
- Continuous assurance: automated evidence collection and continuous monitoring are replacing annual sampling.
Types of audit reports
SSAE 18 is the US attestation standard from the AICPA under which SOC reports are issued. ISAE 3402 is the international equivalent for controls relevant to financial reporting, and ISAE 3000 covers non-financial assurance.
| Report | Covers | Audience |
|---|---|---|
| SOC 1 | Controls relevant to user entities' internal control over financial reporting | User entities' management and their financial auditors |
| SOC 2 | Controls relevant to the Trust Services Criteria: security, availability, processing integrity, confidentiality, privacy | Customers, under NDA; restricted use |
| SOC 3 | Same criteria as SOC 2, summarized without detailed tests | General public, often posted on websites |
| Type | Tests |
|---|---|
| Type 1 | Fairness of the description and suitability of control design at a point in time |
| Type 2 | Design and operating effectiveness over a period, typically six to twelve months |
For a cloud security evaluation, a SOC 2 Type 2 report is usually the most useful because it shows controls working over time. Security is the one criterion always included in a SOC 2; others are added as chosen.
Restrictions of audit scope statements
The scope statement says what the audit covered. Read it before relying on any report.
| Item | What to check |
|---|---|
| Services and locations | Are the services and regions you use included? |
| Period | Does it cover a recent period? Is there a bridge letter for the gap since? |
| Criteria | Which Trust Services Criteria were included? |
| Subservice organizations | Carve-out method excludes their controls; inclusive method includes them |
| Complementary user entity controls (CUECs) | Controls the customer must operate for the provider's controls to work |
| Exceptions and qualified opinions | Controls that failed testing |
CUECs are where shared responsibility meets audit: if the report assumes the customer reviews its own user access, and the customer does not, the assurance does not hold.
Scope statements also restrict use: SOC 1 and SOC 2 reports are intended for specified users, and auditors include disclaimers about what their opinion does not cover.
A worked example
A fintech company reviews a SaaS provider's SOC 2 Type 2 report. The period ended nine months ago, the report uses the carve-out method for its IaaS hosting provider, and it lists a CUEC requiring customers to review user access quarterly. One exception shows a delay in revoking leavers' access.
The company requests a bridge letter, obtains the IaaS provider's own SOC 2 report, starts quarterly access reviews to meet the CUEC, and records the leaver exception and the provider's remediation in its risk register.
How the exam asks about this
- "Which report is MOST suitable for assessing a provider's security controls over time?" SOC 2 Type 2.
- "Which report can be published openly on a provider's website?" SOC 3.
- "A SOC 2 report excludes the controls of the provider's hosting subcontractor. Which method is this?" The carve-out method.
What to remember for the exam
- Internal audit assures management and the board; external audit assures outside parties.
- SOC 1 is financial reporting; SOC 2 is the Trust Services Criteria; SOC 3 is a public summary.
- Type 1 is design at a point in time; Type 2 is operating effectiveness over a period.
- ISAE 3402 is the international counterpart of SOC 1; ISAE 3000 covers non-financial assurance.
- Always read scope, period, carve-outs, CUECs and exceptions.
A clean report covering the wrong services or an old period gives no assurance for what you actually use. Check the scope before reading the opinion.
Common mistakes
Asking for a SOC 1 to assess security. SOC 1 targets financial reporting controls; SOC 2 targets security and related criteria.
Ignoring CUECs. The provider's assurance assumes the customer does its part.
Assuming Type 1 shows controls work. Type 1 tests design only, at one point in time.
Check yourself
What is the difference between SOC 2 Type 1 and Type 2?
Type 1 evaluates control design at a point in time, while Type 2 also tests whether controls operated effectively over a period.
What are complementary user entity controls?
Controls the customer must operate itself for the provider's controls, as described in the report, to achieve their objectives.
Why do providers rely on third-party reports instead of customer audits?
They cannot allow thousands of customers to audit shared facilities, so independent reports give all customers the same assurance.
Topic 3 of 6 in Legal, Risk and Compliance
Test yourself on Legal, Risk and Compliance
The full ISC2 CCSP question bank has 900 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISC2. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.