An auditor finds that the virtual machines sampled last quarter no longer exist, because the cloud environment autoscales and rebuilds instances from images every day, and the hypervisor layer is not visible to the customer. What is the core assurance challenge, and how should the audit adapt?

Virtualization and cloud introduce assurance challenges that traditional audits were not built for: assets are ephemeral and created on demand, infrastructure is abstracted behind the provider's management plane and multiple tenants share underlying hardware the customer cannot inspect. Point-in-time sampling of specific servers fails when those servers no longer exist, so auditors shift to evidence that persists, such as the hardened images and templates instances are built from, configuration and deployment pipeline records, change approvals, management plane audit logs and continuous compliance monitoring results, complemented by provider attestations for layers the customer cannot see. Declaring cloud instances unauditable abandons assurance over material systems and would not satisfy regulators. Suspending autoscaling distorts the very environment being audited, may harm availability and does not reflect how the system normally operates. Granting customer auditors hypervisor administrator rights is not possible in a multi-tenant service and would itself create a severe risk to other tenants. Exam caveat: the customer still needs assurance over the provider's virtualization layer, typically through SOC 2 or ISO/IEC 27001 reports. Operational check: confirm logs and image records are retained for the full audit period and can be tied to each instance that existed.