ABSTRACT
Cloud computing services are finding rapid adoption as organizations seek cost reduction, technical expertise, flexibility, and adaptable mechanisms to attain advantages in fast-moving business environments. The related considerations of governance, audit, and assurance of cloud computing services might be inadvertently overlooked in a rush to adopt these cloud services. This paper focuses on cloud computing governance and audit issues by presenting research questions informed by both practice and research. A cloud computing ecosystem is presented and an IT Governance framework (Wilkin and Chenhall 2010) is referenced as a means to structure research questions. Key issues of risk, security, monitoring, control, and compliance should be considered early in the cloud services decision process. The tight coupling of intercompany operations between the cloud client and cloud provider(s) forms an interdependent, operationally coupled ecosystem. Planned governance is needed to achieve a well-governed, functional, and secure cloud computing environment. The audit role is complicated when the organization’s financial data and/or critical applications are hosted externally with a cloud service provider that may use other cloud service providers.
I. INTRODUCTION
This paper offers a set of key research questions related to governance, audit, and assurance of external cloud computing services. Emphasis is placed on areas where the emergence of cloud computing services requires the attention of board and executive levels, and where cloud computing decisions can result in the need for additional (or modified) governance and audit activities. This cloud research discussion is organized around the perspectives of cooperating parties involved in the cloud computing ecosystem.1 Included in a cloud computing ecosystem are the (1) cloud service users (CSUs) as contracting clients of cloud computing, (2) the cloud service providers (CSPs) of the cloud computing software services (e.g., Software as a Service known as SaaS) that may have contracted with other ‘‘nested’’ CSPs for services (e.g., Platform as a Service, known as PaaS, and Infrastructure as a Service, known as IaaS), (3) the cloud service partner (CSN) to the cloud service providers (CSNs may provide content, application development, or other specialized services), and (4) the external auditors of the cloud computing services. The external auditor role includes the auditors of the CSU and the external auditors of the CSP that offer cloud services to clients.
IV. CONCLUSION
This paper focuses attention on pressing research questions related to the governance and assurance aspects of cloud computing. The topic of cloud computing research builds directly on prior work in corporate and IT governance, services auditing, IT outsourcing, multi-sourcing, and IT infrastructure. Yet, this movement into cloud computing takes the CSU into new governance territory of possible elevated risk. Cloud computing risk may not yet have the sufficient understanding or attention of corporate governance bodies. Risk assessments and governance policies must consider how best to share governance responsibilities with cloud providers. Research is needed to better understand the implications of the boundaryspanning nature of the new cloud-based IT infrastructure, an infrastructure that likely involves multiple layers (whereby the primary CSP is utilizing other CSPs).
