Of the following, to whom should the auditor report the findings?

An organization that is utilizing a community cloud is contracting an auditor to conduct a review on behalf of the group of organizations within the cloud community.

Of the following, to whom should the auditor report the findings?
A . Management of the organization being audited
B . Shareholders and interested parties
C . Cloud service provider
D . Public

View Answer

Answer: A

Explanation:

According to the ISACA Cloud Auditing Knowledge Certificate Study Guide, the auditor should report the findings to the management of the organization being audited, as they are the primary stakeholders and decision makers for the audit. The management is responsible for ensuring that the cloud service provider meets the contractual obligations and service level agreements, as well as the security and compliance requirements of the community cloud. The auditor should also communicate with the cloud service provider and other relevant parties, such as regulators or customers, as appropriate, but the final report should be addressed to the management of the organization being audited.

Reference: ISACA Cloud Auditing Knowledge Certificate Study Guide, page 17