Audit Evidence in Cloud Environments
How auditors gather sufficient and reliable evidence in cloud environments, including shared responsibility challenges and SOC reports.
Auditing cloud environments presents unique challenges to obtaining sufficient and appropriate audit evidence compared to traditional on-premises data centers, primarily because organizations no longer have direct physical access to, or full administrative control over, the underlying infrastructure. CISA candidates must understand how the shared responsibility model shapes evidence-gathering strategies in cloud engagements.
The Shared Responsibility Model and Evidence
In a cloud environment, responsibility for controls is divided between the cloud service provider (CSP) and the customer, with the specific split depending on the service model (IaaS, PaaS, or SaaS). Generally, the CSP is responsible for controls over the physical infrastructure, hypervisor, and underlying network, while the customer retains responsibility for controls over identity and access management, data classification, application configuration, and, depending on the service model, the operating system and middleware layer. Auditors must first identify which controls fall within the customer's scope of evidence-gathering versus which controls require reliance on evidence about the provider.
Relying on Third-Party Assurance Reports
Since customers cannot directly audit a hyperscale cloud provider's data centers, auditors typically rely on independently issued assurance reports covering the provider's controls, most commonly SOC 1 and SOC 2 reports (or ISAE 3402/3000 equivalents internationally), along with ISO 27001 certifications. When relying on such reports, the auditor should verify the report covers the relevant time period and relevant services actually used, review the report for any qualified opinion or noted exceptions, evaluate the complementary user entity controls (CUECs) identified in the report to confirm the customer organization has actually implemented its side of the shared responsibility, and consider whether subservice organizations used by the CSP are appropriately covered (carve-out versus inclusive method).
Bridge Letters
Because SOC report periods often do not align exactly with the audit period under review, auditors may request a bridge letter (gap letter) from the provider, attesting that no significant changes occurred in the control environment between the end of the SOC report period and the current audit date.
Direct Evidence Auditors Can Gather
Beyond third-party assurance reports, auditors can and should gather direct evidence over the customer-controlled layer, including configuration exports from cloud management consoles (such as IAM policies, security group and network configuration, encryption settings, and logging configuration), cloud security posture management (CSPM) tool outputs identifying misconfigurations, API-based access reviews pulling identity and access data directly from the cloud provider's administrative APIs, and log data from cloud-native logging services (such as CloudTrail, Azure Activity Log, or Google Cloud Audit Logs) to evidence actual administrative activity.
Data Residency and Multi-Tenancy Considerations
Auditors should also consider evidence around data residency (confirming data is stored and processed in permitted jurisdictions) and multi-tenancy isolation controls, since cloud environments typically involve shared physical infrastructure across multiple customers, making logical isolation controls (rather than physical separation) the primary safeguard against cross-tenant data exposure.
Challenges Unique to Cloud Evidence Gathering
- Rapid configuration changes possible through infrastructure-as-code and auto-scaling can make point-in-time evidence quickly stale
- Ephemeral resources (containers, serverless functions) may not persist long enough for traditional evidence-gathering approaches
- Distributed ownership across DevOps teams can make identifying a single accountable control owner more difficult
- Provider terms of service may limit the extent of direct penetration testing or security assessment a customer can perform
Exam Relevance
CISA candidates should be able to identify appropriate evidence sources for cloud engagements, understand the purpose and limitations of SOC reports and bridge letters, and recognize that the shared responsibility model does not eliminate the customer's obligation to evidence its own portion of the control environment.