Question

• When considering a private cloud for a large clinic or hospital, identify two key issues that you believe should be examined by the auditor for each of the following risks: (1) regulatory risk, (2) privacy risk, and (3) cyber threat risk.

Answer 1

1. Two key issues in regulatory risks:

(i) Risks associated with non compliance of national or geographical regulations, the industry or service specific legal requirement such as the Sarbanes Oxley Act etc.

(ii) The lack of visibility of the cloud operations and the ability to check for compliance.

2. Privacy risk:

(i) Risk of data leakage such as patient sensitive information to external parties.

(ii) Unauthorized use of confidential data by hospital staff or any external agency.

3. Cyber risk:

(i) The internal control strength of the service provider for data protection.

(ii) Due diligence done by the organization prior to migrating to cloud services.