Internal audit is planning an audit of a customer-facing application deployed across three cloud regions in different countries, using a mix of IaaS and SaaS services. What should the audit plan establish first?
Select an answer to reveal the explanation.
Short Explanation
You don't pack for a trip before you know where you're going. Audit planning starts by nailing down the objectives, what's in scope, what you'll measure against and who and what you'll need. The trap is collecting evidence or writing conclusions before you've decided what the audit is for.
Full Explanation
Audit planning sets the foundation for everything that follows. The auditor defines objectives, the questions the audit must answer, then the scope, which for a distributed cloud deployment must specify regions, jurisdictions, service models, providers and the responsibilities split between customer and provider. Criteria such as policies, regulations or frameworks establish what evidence will be measured against, and the plan identifies resources, skills, timing and the access needed, including provider reports, management plane logs and any contractual audit rights. Multi-region scope also raises legal questions about where evidence may be transferred and which local requirements apply. Collecting logs from every region before objectives exist produces unfocused evidence, may breach data transfer rules and wastes effort on material irrelevant to the audit. Drafting a corrective action plan for expected findings presupposes results; remediation is management's response after findings are reported. Writing the opinion first and steering fieldwork to support it undermines objectivity and the integrity of the audit. Exam caveat: stakeholders, including the provider where its cooperation is needed, should be identified and engaged during planning. Operational check: confirm the approved plan records objectives, scope by region and service, criteria, resources, timeline and the evidence sources agreed with owners.