Certificate of Cloud Auditing Knowledge (CCAK) — Question 269

Due to cloud audit team resource constraints, an audit plan as initially approved cannot be completed. Assuming that the situation is communicated in the cloud audit report, which course of action is MOST relevant?

Answer options

• A. Focusing on auditing high-risk areas
• B. Testing the adequacy of cloud controls design
• C. Relying on management testing of cloud controls
• D. Testing the operational effectiveness of cloud controls

Correct answer: A

Explanation

The correct answer is A because prioritizing high-risk areas ensures that the most critical aspects of the audit are addressed, given the resource limitations. Options B, C, and D are less relevant in this context since the focus is on managing limited resources effectively rather than testing or relying on controls that may not directly mitigate high risks.