Will the cloud help auditors do their job more easily or better?
Organizations migrating huge amounts of data to the cloud has become one of the features of the digital age. The cloud represents a new paradigm for computing – reducing storage and running costs for companies, increasing flexibility, providing the capability of adjusting (also known as 'spinning') capacity up and down, and increasing functionality and processing power.
While some organizations may prefer to keep their data in on-premise servers, there is no doubt that the move to the cloud continues to grow.
But what of auditing? Will the cloud help auditors do their job more easily or better?
Auditing and the Cloud
The answer is – yes. A cloud environment can make auditing more centralized, easier to access across geographies and more efficient. For example, with a multi-national that operates in the cloud, whether a transaction is made in Canada, the US or in India, it will be recorded centrally in a particular cloud environment and updated/replicated across geographic-specific systems accordingly. As part of this transition, auditors will have to rethink how they try to address the same risks which could significantly vary with the introduction of additional centralized automated controls.
As audits become increasingly digital, auditors will be required to collect more digital data for advance analytics. This data is going to be available 24/7 in the cloud and auditors across borders will be able to interact far more seamlessly. The cloud might, therefore, aid auditors in extracting data that may be harder to locate within Enterprise Resource Planning (ERP) and other physical systems. Information can also be archived more accessibly. Data stored in the cloud is searchable too – offering the prospect, in the future, of an auditor performing advanced queries using a voice-activated digital assistant and advanced AI tools: "Look up the invoices from 2017 between companies A and B and find this specific item."
Access to data may become more mobile through the cloud as well, enabling auditors to work more effectively remotely. With the centric nature of the cloud structure using access controls like facial recognition technology and various encryption techniques, it allows data to be more secure compared to physical archives where unauthorized people might gain access.
Furthermore, as cloud technologies allow for a radical transformation in their processes, such as automation and centralization, companies should strategize how to leverage these technologies for the automated generation of audit evidence and its respective analysis. While control objectives may remain the same for organizations, auditors will have to re-think how to approach control testing. Automation will enable organizations to perform activities with minimal user intervention, which reduces errors and generates information trails in a detailed fashion. Centralization of data will enable auditors to examine the information from specific systems and help in devoting the right amount of effort to the appropriate areas during the review.
Embracing the cloud also comes with challenges that need to be addressed. With all the new concepts, technologies and implementations of cloud environments and solutions, auditors will need to have a minimum level of technology understanding in order to observe, analyze and effectively leverage these new approaches to be able to deliver greater quality in their audits.
The audit of the future will be hosted in the cloud
Auditors can empower their judgment, experience, and skepticism with data science, sophisticated analysis and new technologies that leverage the cloud. KPMG Clara, our smart auditing platform is designed to be hosted by Microsoft Azure on a private cloud network, providing flexibility and high levels of control and security. KPMG Clara offers scalability of advanced data and analytics (D&A) processing and the ability to add as much capacity as needed, for example during times of peak activity. KPMG Clara is a blueprint for hosting the audit of the future.
An increase in audit quality?
As we have seen, the cloud can make the retrieval of data needed for the audit faster and easier, expanding the search functionality and enhancing the precision of auditor inquiries.
In combination with other new technologies such as robotic process automation and artificial intelligence, the use of the cloud could also facilitate the analysis of 100 percent of datasets.
The cloud in combination with other technologies is, therefore, itself a driver of better audit quality.
What is the cloud?
Cloud computing is the delivery of computing services and storage capabilities through the internet ('the cloud'). Cloud providers like Microsoft offer computing storage and services that they host themselves — meaning companies do not necessarily have to manage and invest in their own on-premise servers. Because it is virtual, the cloud offers far greater capacity, speed, and configurability than traditional physical servers. There are three main types of cloud: public, private and hybrid. Public cloud is owned and run by the cloud provider, with users 'renting' storage and capacity in a shared facility. Private cloud is used exclusively by one organization, with the cloud either being located on the company's on-site data center or hosted by a third-party provider. A hybrid cloud is a combination of the two.
There are three main types of cloud service:
When implementing cloud solutions, companies should remain cognizant of data residency issues and the inherent joint responsibility for data security with their Cloud Service Provider.
© 2020 KPMG LLP, a Canada limited liability partnership and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved.
KPMG International Cooperative (“KPMG International”) is a Swiss entity. Member firms of the KPMG network of independent firms are affiliated with KPMG International. KPMG International provides no client services. No member firm has any authority to obligate or bind KPMG International or any other member firm vis-à-vis third parties, nor does KPMG International have any such authority to obligate or bind any member firm.