Regarding suppliers of a cloud service provider, it is most important for the auditor to be aware that

the client organization has a clear understanding of the provider’s suppliers. This is because cloud

services often involve multiple parties in the supply chain, such as cloud providers, sub-providers,

brokers, carriers, and auditors. Each party may have different roles and responsibilities in delivering

the cloud services and ensuring their quality, security, and compliance. Therefore, it is essential for

the client organization to have visibility and assurance of the performance and compliance of the

provider’s suppliers and to establish clear and transparent agreements with them regarding their

roles, responsibilities, expectations, and obligations.12

An auditor should be aware of the importance of the client organization’s understanding of the

provider’s suppliers because it provides a basis for assessing the risks and challenges associated with

outsourcing services to a cloud provider and its supply chain. An auditor can use the client

organization’s understanding of the provider’s suppliers to verify that the client organization has

conducted a thorough due diligence of the provider’s suppliers and their capabilities, qualifications,

certifications, and reputation. An auditor can also use the client organization’s understanding of the

provider’s suppliers to evaluate whether the client organization has implemented adequate controls

and processes to monitor, audit, or verify the security and compliance status of their cloud services

and data across the supply chain. An auditor can also use the client organization’s understanding of

the provider’s suppliers to identify any gaps or weaknesses in the client organization’s security

management program and to provide recommendations for improvement.34

Reference := Practical Guide to Cloud Service Agreements Version 2.01; HIDDEN

INTERDEPENDENCIES BETWEEN INFORMATION AND ORGANIZATIONAL …2; Cloud Computing: The

Audit Challenge - ISACA3; Cloud Computing: Audit Considerations - AICPA4