An auditor examining a cloud service provider’s service level agreement (SLA) should be MOST concerned about whether:

An auditor examining a cloud service provider’s service level agreement (SLA) should be MOST concerned about whether:

A. the agreement includes any operational matters that are material to the service operations.

B. the agreement excludes any sourcing and financial matters that are material in meeting the service level agreement (SLA).

C. the agreement includes any service availability matters that are material to the service operations.

D. the agreement excludes any operational matters that are material to the service operations

View Answer

Answer: D

Explanation:

An auditor examining a cloud service provider’s SLA should be most concerned about whether the agreement excludes any operational matters that are material to the service operations, as this could indicate a lack of transparency, accountability, and quality assurance from the provider. Operational matters are the aspects of the cloud service that affect its functionality, performance, availability, reliability, security, and compliance. Examples of operational matters include service scope, roles and responsibilities, service levels and metrics, monitoring and reporting mechanisms, incident and problem management, change management, backup and recovery, data protection and privacy, and termination and exit clauses12. These matters are material to the service operations if they have a significant impact on the achievement of the service objectives and expectations of the cloud customer. The auditor should verify that the SLA covers all the relevant and material operational matters in a clear and comprehensive manner, and that the provider adheres to the SLA terms and conditions.

The other options are not the most concerning for the auditor.

Option A is a desirable feature of an SLA, but not a concern if it is missing.

Option B is an unrealistic expectation of an SLA, as sourcing and financial matters are usually essential in meeting the SLA.

Option C is a specific example of an operational matter that is material to the service operations, but not the only one that should be included in the SLA.

Reference: Cloud Services Due Diligence Checklist

Cloud Computing: Agencies Need to Incorporate Key Practices to Ensure Effective Performance